From 8a30a5609dde75b3e930c5bb9d3f9e6e73e6335a Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Wed, 9 Oct 2024 16:02:36 +0000 Subject: [PATCH 1/5] chore: move argtype and reduce type variance --- go.mod | 2 + pkg/bufferdecoder/eventsreader.go | 134 +- pkg/bufferdecoder/eventsreader_test.go | 6 +- pkg/ebpf/c/types.h | 3 +- pkg/ebpf/tracee.go | 18 +- pkg/events/core.go | 1546 +++++++++++----------- pkg/events/derive/symbols_loaded_test.go | 2 +- pkg/events/parse/params.go | 70 +- pkg/policy/ebpf.go | 30 +- pkg/policy/policy_manager.go | 6 +- pkg/server/grpc/event_data_test.go | 12 +- types/trace/trace.go | 64 +- types/trace/trace_test.go | 2 +- 13 files changed, 929 insertions(+), 966 deletions(-) diff --git a/go.mod b/go.mod index 9d9c48c2f1dc..beb634b7f8db 100644 --- a/go.mod +++ b/go.mod @@ -179,3 +179,5 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect kernel.org/pub/linux/libs/security/libcap/psx v1.2.70 // indirect ) + +replace github.com/aquasecurity/tracee/types => ./types diff --git a/pkg/bufferdecoder/eventsreader.go b/pkg/bufferdecoder/eventsreader.go index cf829e4c07a5..4e666cc97bd8 100644 --- a/pkg/bufferdecoder/eventsreader.go +++ b/pkg/bufferdecoder/eventsreader.go @@ -13,40 +13,6 @@ import ( "github.com/aquasecurity/tracee/types/trace" ) -// argType is an enum that encodes the argument types that the BPF program may write to the shared buffer -// argument types should match defined values in ebpf code -type ArgType uint8 - -const ( - noneT ArgType = iota - intT - uintT - longT - ulongT - offT - modeT - devT - sizeT - pointerT - strT - strArrT - sockAddrT - bytesT - u16T - credT - intArr2T - uint64ArrT - u8T - timespecT -) - -// These types don't match the ones defined in the ebpf code since they are not being used by syscalls arguments. -// They have their own set of value to avoid collision in the future. -const ( - argsArrT ArgType = iota + 0x80 - boolT -) - // readArgFromBuff read the next argument from the buffer. // Return the index of the argument and the parsed argument. func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.ArgMeta, @@ -69,47 +35,47 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A argType := GetParamType(arg.Type) switch argType { - case u8T: + case trace.U8_T: var data uint8 err = ebpfMsgDecoder.DecodeUint8(&data) res = data - case u16T: + case trace.U16_T: var data uint16 err = ebpfMsgDecoder.DecodeUint16(&data) res = data - case intT: + case trace.INT_T: var data int32 err = ebpfMsgDecoder.DecodeInt32(&data) res = data - case uintT, devT, modeT: + case trace.UINT_T: var data uint32 err = ebpfMsgDecoder.DecodeUint32(&data) res = data - case longT: + case trace.LONG_T: var data int64 err = ebpfMsgDecoder.DecodeInt64(&data) res = data - case ulongT, offT, sizeT: + case trace.ULONG_T: var data uint64 err = ebpfMsgDecoder.DecodeUint64(&data) res = data - case boolT: + case trace.BOOL_T: var data bool err = ebpfMsgDecoder.DecodeBool(&data) res = data - case pointerT: + case trace.POINTER_T: var data uint64 err = ebpfMsgDecoder.DecodeUint64(&data) res = uintptr(data) - case sockAddrT: + case trace.SOCK_ADDR_T: res, err = readSockaddrFromBuff(ebpfMsgDecoder) - case credT: + case trace.CRED_T: var data SlimCred err = ebpfMsgDecoder.DecodeSlimCred(&data) res = trace.SlimCred(data) // here we cast to trace.SlimCred to ensure we send the public interface and not bufferdecoder.SlimCred - case strT: + case trace.STR_T: res, err = readStringFromBuff(ebpfMsgDecoder) - case strArrT: + case trace.STR_ARR_T: // TODO optimization: create slice after getting arrLen var ss []string var arrLen uint8 @@ -125,7 +91,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A ss = append(ss, s) } res = ss - case argsArrT: + case trace.ARGS_ARR_T: var ss []string var arrLen uint32 var argNum uint32 @@ -150,7 +116,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A ss = append(ss, "?") } res = ss - case bytesT: + case trace.BYTES_T: var size uint32 err = ebpfMsgDecoder.DecodeUint32(&size) if err != nil { @@ -161,21 +127,21 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A return uint(argIdx), arg, errfmt.Errorf("byte array size too big: %d", size) } res, err = ReadByteSliceFromBuff(ebpfMsgDecoder, int(size)) - case intArr2T: + case trace.INT_ARR_2_T: var intArray [2]int32 err = ebpfMsgDecoder.DecodeIntArray(intArray[:], 2) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading int elements: %v", err) } res = intArray - case uint64ArrT: + case trace.UINT64_ARR_T: ulongArray := make([]uint64, 0) err := ebpfMsgDecoder.DecodeUint64Array(&ulongArray) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading ulong elements: %v", err) } res = ulongArray - case timespecT: + case trace.TIMESPEC_T: var sec int64 var nsec int64 err = ebpfMsgDecoder.DecodeInt64(&sec) @@ -196,53 +162,45 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A return uint(argIdx), arg, nil } -func GetParamType(paramType string) ArgType { +func GetParamType(paramType string) trace.DecodeAs { switch paramType { - case "int", "pid_t", "uid_t", "gid_t", "mqd_t", "clockid_t", "const clockid_t", "key_t", "key_serial_t", "timer_t": - return intT - case "unsigned int", "u32": - return uintT + case "int": + return trace.INT_T + case "unsigned int": + return trace.UINT_T case "long": - return longT - case "unsigned long", "u64": - return ulongT + return trace.LONG_T + case "unsigned long": + return trace.ULONG_T + case "u16": + return trace.U16_T + case "u8": + return trace.U8_T case "bool": - return boolT - case "off_t", "loff_t": - return offT - case "mode_t": - return modeT - case "dev_t": - return devT - case "size_t": - return sizeT - case "void*", "const void*": - return pointerT - case "char*", "const char*": - return strT + return trace.BOOL_T + case "void*": + return trace.POINTER_T + case "char*": + return trace.STR_T case "const char*const*": // used by execve(at) argv and env - return strArrT - case "const char**": // used by sched_process_exec argv and envp - return argsArrT - case "const struct sockaddr*", "struct sockaddr*": - return sockAddrT + return trace.STR_ARR_T + case "const char**": // used by sched_process_exec argv and env + return trace.ARGS_ARR_T + case "struct sockaddr*": + return trace.SOCK_ADDR_T case "bytes": - return bytesT + return trace.BYTES_T case "int[2]": - return intArr2T + return trace.INT_ARR_2_T case "slim_cred_t": - return credT - case "umode_t": - return u16T - case "u8": - return u8T + return trace.CRED_T case "unsigned long[]", "[]trace.HookedSymbolData": - return uint64ArrT - case "struct timespec*", "const struct timespec*": - return timespecT + return trace.UINT64_ARR_T + case "struct timespec*": + return trace.TIMESPEC_T default: // Default to pointer (printed as hex) for unsupported types - return pointerT + return trace.POINTER_T } } diff --git a/pkg/bufferdecoder/eventsreader_test.go b/pkg/bufferdecoder/eventsreader_test.go index e86df7930e2b..5ffd7a207fbc 100644 --- a/pkg/bufferdecoder/eventsreader_test.go +++ b/pkg/bufferdecoder/eventsreader_test.go @@ -64,7 +64,7 @@ func TestReadArgFromBuff(t *testing.T) { input: []byte{0, 0xFF, 0xFF, 0xFF, 0xFF, // 4294967295 }, - params: []trace.ArgMeta{{Type: "dev_t", Name: "devT0"}}, + params: []trace.ArgMeta{{Type: "unsigned int", Name: "devT0"}}, expectedArg: uint32(4294967295), }, { @@ -72,7 +72,7 @@ func TestReadArgFromBuff(t *testing.T) { input: []byte{0, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, // 18446744073709551615 }, - params: []trace.ArgMeta{{Type: "off_t", Name: "offT0"}}, + params: []trace.ArgMeta{{Type: "long", Name: "offT0"}}, expectedArg: uint64(18446744073709551615), }, { @@ -161,7 +161,7 @@ func TestReadArgFromBuff(t *testing.T) { input: []byte{1, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, // 18446744073709551615 }, - params: []trace.ArgMeta{{Type: "const char*", Name: "str0"}, {Type: "off_t", Name: "offT1"}}, + params: []trace.ArgMeta{{Type: "const char*", Name: "str0"}, {Type: "long", Name: "offT1"}}, expectedArg: uint64(18446744073709551615), }, } diff --git a/pkg/ebpf/c/types.h b/pkg/ebpf/c/types.h index b6ee3df138f4..b8679fd68b71 100644 --- a/pkg/ebpf/c/types.h +++ b/pkg/ebpf/c/types.h @@ -154,7 +154,8 @@ typedef struct args { } args_t; // NOTE: If any fields are added to argument_type_e, the array type_size_table -// (and related defines) must be updated accordingly. +// (and related defines) must be updated accordingly. Corresponds to the ArgType enum in +// pkg/bufferdecoder/eventsreader.go. enum argument_type_e { NONE_T = 0UL, diff --git a/pkg/ebpf/tracee.go b/pkg/ebpf/tracee.go index 0945566e034e..ae746ff5ef05 100644 --- a/pkg/ebpf/tracee.go +++ b/pkg/ebpf/tracee.go @@ -66,11 +66,11 @@ type Tracee struct { stats metrics.Stats sigEngine *engine.Engine // Events - eventsSorter *sorting.EventsChronologicalSorter - eventsPool *sync.Pool - eventsParamTypes map[events.ID][]bufferdecoder.ArgType - eventProcessor map[events.ID][]func(evt *trace.Event) error - eventDerivations derive.Table + eventsSorter *sorting.EventsChronologicalSorter + eventsPool *sync.Pool + eventArgumentTypes map[events.ID][]trace.DecodeAs + eventProcessor map[events.ID][]func(evt *trace.Event) error + eventDerivations derive.Table // Artifacts fileHashes *filehash.Cache capturedFiles map[string]int64 @@ -417,12 +417,12 @@ func (t *Tracee) Init(ctx gocontext.Context) error { // Initialize events parameter types map - t.eventsParamTypes = make(map[events.ID][]bufferdecoder.ArgType) + t.eventArgumentTypes = make(map[events.ID][]trace.DecodeAs) for _, eventDefinition := range events.Core.GetDefinitions() { id := eventDefinition.GetID() params := eventDefinition.GetParams() for _, param := range params { - t.eventsParamTypes[id] = append(t.eventsParamTypes[id], bufferdecoder.GetParamType(param.Type)) + t.eventArgumentTypes[id] = append(t.eventArgumentTypes[id], bufferdecoder.GetDecodeType(param.Type)) } } @@ -1115,7 +1115,7 @@ func (t *Tracee) populateFilterMaps(updateProcTree bool) error { polCfg, err := t.policyManager.UpdateBPF( t.bpfModule, t.containers, - t.eventsParamTypes, + t.eventArgumentTypes, true, updateProcTree, ) @@ -1277,7 +1277,7 @@ func (t *Tracee) initBPF() error { } // returned PoliciesConfig is not used here, therefore it's discarded - _, err = t.policyManager.UpdateBPF(t.bpfModule, t.containers, t.eventsParamTypes, false, true) + _, err = t.policyManager.UpdateBPF(t.bpfModule, t.containers, t.eventArgumentTypes, false, true) if err != nil { return errfmt.WrapError(err) } diff --git a/pkg/events/core.go b/pkg/events/core.go index e7b2e60cfe4c..9a945bee7605 100644 --- a/pkg/events/core.go +++ b/pkg/events/core.go @@ -212,7 +212,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "count"}, + {Type: "unsigned long", Name: "count"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -237,7 +237,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "count"}, + {Type: "unsigned long", Name: "count"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -260,9 +260,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, - {Type: "mode_t", Name: "mode"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -308,8 +308,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -333,7 +333,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct stat*", Name: "statbuf"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -356,8 +356,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -380,7 +380,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ - {Type: "struct pollfd*", Name: "fds"}, + {Type: "void*", Name: "fds"}, {Type: "unsigned int", Name: "nfds"}, {Type: "int", Name: "timeout"}, }, @@ -406,7 +406,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "offset"}, + {Type: "long", Name: "offset"}, {Type: "unsigned int", Name: "whence"}, }, dependencies: Dependencies{ @@ -431,11 +431,11 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, {Type: "int", Name: "prot"}, {Type: "int", Name: "flags"}, {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "off"}, + {Type: "long", Name: "off"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -459,7 +459,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "prot"}, }, dependencies: Dependencies{ @@ -484,7 +484,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -531,9 +531,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ {Type: "int", Name: "signum"}, - {Type: "const struct sigaction*", Name: "act"}, - {Type: "struct sigaction*", Name: "oldact"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "act"}, + {Type: "void*", Name: "oldact"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -557,9 +557,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ {Type: "int", Name: "how"}, - {Type: "sigset_t*", Name: "set"}, - {Type: "sigset_t*", Name: "oldset"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "set"}, + {Type: "void*", Name: "oldset"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -630,8 +630,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "count"}, - {Type: "off_t", Name: "offset"}, + {Type: "unsigned long", Name: "count"}, + {Type: "long", Name: "offset"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -655,9 +655,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const void*", Name: "buf"}, - {Type: "size_t", Name: "count"}, - {Type: "off_t", Name: "offset"}, + {Type: "void*", Name: "buf"}, + {Type: "unsigned long", Name: "count"}, + {Type: "long", Name: "offset"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -681,7 +681,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "int", Name: "iovcnt"}, }, dependencies: Dependencies{ @@ -706,7 +706,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "int", Name: "iovcnt"}, }, dependencies: Dependencies{ @@ -730,7 +730,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "mode"}, }, dependencies: Dependencies{ @@ -778,10 +778,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ {Type: "int", Name: "nfds"}, - {Type: "fd_set*", Name: "readfds"}, - {Type: "fd_set*", Name: "writefds"}, - {Type: "fd_set*", Name: "exceptfds"}, - {Type: "struct timeval*", Name: "timeout"}, + {Type: "void*", Name: "readfds"}, + {Type: "void*", Name: "writefds"}, + {Type: "void*", Name: "exceptfds"}, + {Type: "void*", Name: "timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -826,8 +826,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "old_address"}, - {Type: "size_t", Name: "old_size"}, - {Type: "size_t", Name: "new_size"}, + {Type: "unsigned long", Name: "old_size"}, + {Type: "unsigned long", Name: "new_size"}, {Type: "int", Name: "flags"}, {Type: "void*", Name: "new_address"}, }, @@ -853,7 +853,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_sync"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -878,7 +878,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, {Type: "unsigned char*", Name: "vec"}, }, dependencies: Dependencies{ @@ -903,7 +903,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, {Type: "int", Name: "advice"}, }, dependencies: Dependencies{ @@ -927,8 +927,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_shm"}, params: []trace.ArgMeta{ - {Type: "key_t", Name: "key"}, - {Type: "size_t", Name: "size"}, + {Type: "int", Name: "key"}, + {Type: "unsigned long", Name: "size"}, {Type: "int", Name: "shmflg"}, }, dependencies: Dependencies{ @@ -953,7 +953,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_shm"}, params: []trace.ArgMeta{ {Type: "int", Name: "shmid"}, - {Type: "const void*", Name: "shmaddr"}, + {Type: "void*", Name: "shmaddr"}, {Type: "int", Name: "shmflg"}, }, dependencies: Dependencies{ @@ -979,7 +979,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "shmid"}, {Type: "int", Name: "cmd"}, - {Type: "struct shmid_ds*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1058,7 +1058,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "const struct timespec*", Name: "req"}, + {Type: "struct timespec*", Name: "req"}, {Type: "struct timespec*", Name: "rem"}, }, dependencies: Dependencies{ @@ -1083,7 +1083,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ {Type: "int", Name: "which"}, - {Type: "struct itimerval*", Name: "curr_value"}, + {Type: "void*", Name: "curr_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1130,8 +1130,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ {Type: "int", Name: "which"}, - {Type: "struct itimerval*", Name: "new_value"}, - {Type: "struct itimerval*", Name: "old_value"}, + {Type: "void*", Name: "new_value"}, + {Type: "void*", Name: "old_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1178,7 +1178,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "out_fd"}, {Type: "int", Name: "in_fd"}, {Type: "off_t*", Name: "offset"}, - {Type: "size_t", Name: "count"}, + {Type: "unsigned long", Name: "count"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1278,7 +1278,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "flags"}, {Type: "struct sockaddr*", Name: "dest_addr"}, {Type: "int", Name: "addrlen"}, @@ -1306,7 +1306,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "flags"}, {Type: "struct sockaddr*", Name: "src_addr"}, {Type: "int*", Name: "addrlen"}, @@ -1333,7 +1333,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "net", "net_snd_rcv"}, params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, - {Type: "struct msghdr*", Name: "msg"}, + {Type: "void*", Name: "msg"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -1358,7 +1358,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "net", "net_snd_rcv"}, params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, - {Type: "struct msghdr*", Name: "msg"}, + {Type: "void*", Name: "msg"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -1534,7 +1534,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "sockfd"}, {Type: "int", Name: "level"}, {Type: "int", Name: "optname"}, - {Type: "const void*", Name: "optval"}, + {Type: "void*", Name: "optval"}, {Type: "int", Name: "optlen"}, }, dependencies: Dependencies{ @@ -1654,7 +1654,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_life"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "const char*const*", Name: "argv"}, {Type: "const char*const*", Name: "envp"}, }, @@ -1704,10 +1704,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_life"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "int*", Name: "wstatus"}, {Type: "int", Name: "options"}, - {Type: "struct rusage*", Name: "rusage"}, + {Type: "void*", Name: "rusage"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1730,7 +1730,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "int", Name: "sig"}, }, dependencies: Dependencies{ @@ -1754,7 +1754,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ - {Type: "struct utsname*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1777,7 +1777,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_sem"}, params: []trace.ArgMeta{ - {Type: "key_t", Name: "key"}, + {Type: "int", Name: "key"}, {Type: "int", Name: "nsems"}, {Type: "int", Name: "semflg"}, }, @@ -1803,8 +1803,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_sem"}, params: []trace.ArgMeta{ {Type: "int", Name: "semid"}, - {Type: "struct sembuf*", Name: "sops"}, - {Type: "size_t", Name: "nsops"}, + {Type: "void*", Name: "sops"}, + {Type: "unsigned long", Name: "nsops"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1853,7 +1853,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_shm"}, params: []trace.ArgMeta{ - {Type: "const void*", Name: "shmaddr"}, + {Type: "void*", Name: "shmaddr"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -1876,7 +1876,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "key_t", Name: "key"}, + {Type: "int", Name: "key"}, {Type: "int", Name: "msgflg"}, }, dependencies: Dependencies{ @@ -1901,8 +1901,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ {Type: "int", Name: "msqid"}, - {Type: "struct msgbuf*", Name: "msgp"}, - {Type: "size_t", Name: "msgsz"}, + {Type: "void*", Name: "msgp"}, + {Type: "unsigned long", Name: "msgsz"}, {Type: "int", Name: "msgflg"}, }, dependencies: Dependencies{ @@ -1927,8 +1927,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ {Type: "int", Name: "msqid"}, - {Type: "struct msgbuf*", Name: "msgp"}, - {Type: "size_t", Name: "msgsz"}, + {Type: "void*", Name: "msgp"}, + {Type: "unsigned long", Name: "msgsz"}, {Type: "long", Name: "msgtyp"}, {Type: "int", Name: "msgflg"}, }, @@ -1955,7 +1955,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "msqid"}, {Type: "int", Name: "cmd"}, - {Type: "struct msqid_ds*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2073,8 +2073,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "off_t", Name: "length"}, + {Type: "char*", Name: "path"}, + {Type: "long", Name: "length"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2098,7 +2098,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "length"}, + {Type: "long", Name: "length"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2122,7 +2122,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct linux_dirent*", Name: "dirp"}, + {Type: "void*", Name: "dirp"}, {Type: "unsigned int", Name: "count"}, }, dependencies: Dependencies{ @@ -2147,7 +2147,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ {Type: "char*", Name: "buf"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2170,7 +2170,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2216,8 +2216,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "oldpath"}, - {Type: "const char*", Name: "newpath"}, + {Type: "char*", Name: "oldpath"}, + {Type: "char*", Name: "newpath"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2240,8 +2240,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2264,7 +2264,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2287,8 +2287,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2311,8 +2311,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "oldpath"}, - {Type: "const char*", Name: "newpath"}, + {Type: "char*", Name: "oldpath"}, + {Type: "char*", Name: "newpath"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2335,7 +2335,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2358,8 +2358,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "target"}, - {Type: "const char*", Name: "linkpath"}, + {Type: "char*", Name: "target"}, + {Type: "char*", Name: "linkpath"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2382,9 +2382,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "char*", Name: "buf"}, - {Type: "size_t", Name: "bufsiz"}, + {Type: "unsigned long", Name: "bufsiz"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2407,8 +2407,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2432,7 +2432,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "mode_t", Name: "mode"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2455,9 +2455,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "uid_t", Name: "owner"}, - {Type: "gid_t", Name: "group"}, + {Type: "char*", Name: "pathname"}, + {Type: "int", Name: "owner"}, + {Type: "int", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2481,8 +2481,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "uid_t", Name: "owner"}, - {Type: "gid_t", Name: "group"}, + {Type: "int", Name: "owner"}, + {Type: "int", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2505,9 +2505,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "uid_t", Name: "owner"}, - {Type: "gid_t", Name: "group"}, + {Type: "char*", Name: "pathname"}, + {Type: "int", Name: "owner"}, + {Type: "int", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2530,7 +2530,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "mode_t", Name: "mask"}, + {Type: "unsigned int", Name: "mask"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2553,8 +2553,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_tod"}, params: []trace.ArgMeta{ - {Type: "struct timeval*", Name: "tv"}, - {Type: "struct timezone*", Name: "tz"}, + {Type: "void*", Name: "tv"}, + {Type: "void*", Name: "tz"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2578,7 +2578,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ {Type: "int", Name: "resource"}, - {Type: "struct rlimit*", Name: "rlim"}, + {Type: "void*", Name: "rlim"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2602,7 +2602,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ {Type: "int", Name: "who"}, - {Type: "struct rusage*", Name: "usage"}, + {Type: "void*", Name: "usage"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2625,7 +2625,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ - {Type: "struct sysinfo*", Name: "info"}, + {Type: "void*", Name: "info"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2648,7 +2648,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "struct tms*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2672,7 +2672,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "proc"}, params: []trace.ArgMeta{ {Type: "long", Name: "request"}, - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "void*", Name: "addr"}, {Type: "void*", Name: "data"}, }, @@ -2758,7 +2758,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "uid_t", Name: "uid"}, + {Type: "int", Name: "uid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2781,7 +2781,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "gid_t", Name: "gid"}, + {Type: "int", Name: "gid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2846,8 +2846,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "pid_t", Name: "pgid"}, + {Type: "int", Name: "pid"}, + {Type: "int", Name: "pgid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2933,8 +2933,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "uid_t", Name: "ruid"}, - {Type: "uid_t", Name: "euid"}, + {Type: "int", Name: "ruid"}, + {Type: "int", Name: "euid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -2957,8 +2957,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "gid_t", Name: "rgid"}, - {Type: "gid_t", Name: "egid"}, + {Type: "int", Name: "rgid"}, + {Type: "int", Name: "egid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3029,9 +3029,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "uid_t", Name: "ruid"}, - {Type: "uid_t", Name: "euid"}, - {Type: "uid_t", Name: "suid"}, + {Type: "int", Name: "ruid"}, + {Type: "int", Name: "euid"}, + {Type: "int", Name: "suid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3079,9 +3079,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "gid_t", Name: "rgid"}, - {Type: "gid_t", Name: "egid"}, - {Type: "gid_t", Name: "sgid"}, + {Type: "int", Name: "rgid"}, + {Type: "int", Name: "egid"}, + {Type: "int", Name: "sgid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3129,7 +3129,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3152,7 +3152,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "uid_t", Name: "fsuid"}, + {Type: "int", Name: "fsuid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3175,7 +3175,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "gid_t", Name: "fsgid"}, + {Type: "int", Name: "fsgid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3198,7 +3198,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_ids"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3221,8 +3221,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "cap_user_header_t", Name: "hdrp"}, - {Type: "cap_user_data_t", Name: "datap"}, + {Type: "void*", Name: "hdrp"}, + {Type: "void*", Name: "datap"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3245,8 +3245,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "cap_user_header_t", Name: "hdrp"}, - {Type: "const cap_user_data_t", Name: "datap"}, + {Type: "void*", Name: "hdrp"}, + {Type: "void*", Name: "datap"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3269,8 +3269,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ - {Type: "sigset_t*", Name: "set"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "set"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3295,8 +3295,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "const sigset_t*", Name: "set"}, {Type: "siginfo_t*", Name: "info"}, - {Type: "const struct timespec*", Name: "timeout"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "struct timespec*", Name: "timeout"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3319,7 +3319,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "tgid"}, + {Type: "int", Name: "tgid"}, {Type: "int", Name: "sig"}, {Type: "siginfo_t*", Name: "info"}, }, @@ -3344,8 +3344,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ - {Type: "sigset_t*", Name: "mask"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "mask"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3392,7 +3392,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "filename"}, + {Type: "char*", Name: "filename"}, {Type: "const struct utimbuf*", Name: "times"}, }, dependencies: Dependencies{ @@ -3416,9 +3416,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, + {Type: "unsigned int", Name: "dev"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3441,7 +3441,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "library"}, + {Type: "char*", Name: "library"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3487,8 +3487,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_info"}, params: []trace.ArgMeta{ - {Type: "dev_t", Name: "dev"}, - {Type: "struct ustat*", Name: "ubuf"}, + {Type: "unsigned int", Name: "dev"}, + {Type: "void*", Name: "ubuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3511,8 +3511,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_info"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "struct statfs*", Name: "buf"}, + {Type: "char*", Name: "path"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3536,7 +3536,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_info"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct statfs*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3631,8 +3631,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "struct sched_param*", Name: "param"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "param"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3655,8 +3655,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "struct sched_param*", Name: "param"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "param"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3679,9 +3679,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "int", Name: "policy"}, - {Type: "struct sched_param*", Name: "param"}, + {Type: "void*", Name: "param"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3704,7 +3704,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3773,7 +3773,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "struct timespec*", Name: "tp"}, }, dependencies: Dependencies{ @@ -3797,8 +3797,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "void*", Name: "addr"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3821,8 +3821,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "void*", Name: "addr"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3935,8 +3935,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "new_root"}, - {Type: "const char*", Name: "put_old"}, + {Type: "char*", Name: "new_root"}, + {Type: "char*", Name: "put_old"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -3959,7 +3959,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ - {Type: "struct __sysctl_args*", Name: "args"}, + {Type: "void*", Name: "args"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4027,7 +4027,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "struct timex*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4051,7 +4051,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ {Type: "int", Name: "resource"}, - {Type: "const struct rlimit*", Name: "rlim"}, + {Type: "void*", Name: "rlim"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4074,7 +4074,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4118,7 +4118,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "filename"}, + {Type: "char*", Name: "filename"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4141,8 +4141,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_tod"}, params: []trace.ArgMeta{ - {Type: "const struct timeval*", Name: "tv"}, - {Type: "const struct timezone*", Name: "tz"}, + {Type: "void*", Name: "tv"}, + {Type: "void*", Name: "tz"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4165,11 +4165,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "source"}, - {Type: "const char*", Name: "target"}, - {Type: "const char*", Name: "filesystemtype"}, + {Type: "char*", Name: "source"}, + {Type: "char*", Name: "target"}, + {Type: "char*", Name: "filesystemtype"}, {Type: "unsigned long", Name: "mountflags"}, - {Type: "const void*", Name: "data"}, + {Type: "void*", Name: "data"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4192,7 +4192,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "target"}, + {Type: "char*", Name: "target"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -4216,7 +4216,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, {Type: "int", Name: "swapflags"}, }, dependencies: Dependencies{ @@ -4240,7 +4240,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4289,8 +4289,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "net"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "size_t", Name: "len"}, + {Type: "char*", Name: "name"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4313,8 +4313,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "net"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "size_t", Name: "len"}, + {Type: "char*", Name: "name"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4408,7 +4408,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "void*", Name: "module_image"}, {Type: "unsigned long", Name: "len"}, - {Type: "const char*", Name: "param_values"}, + {Type: "char*", Name: "param_values"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4431,7 +4431,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system", "system_module"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -4498,7 +4498,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ {Type: "int", Name: "cmd"}, - {Type: "const char*", Name: "special"}, + {Type: "char*", Name: "special"}, {Type: "int", Name: "id"}, {Type: "void*", Name: "addr"}, }, @@ -4671,8 +4671,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "offset"}, - {Type: "size_t", Name: "count"}, + {Type: "long", Name: "offset"}, + {Type: "unsigned long", Name: "count"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4695,10 +4695,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, - {Type: "const void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, + {Type: "void*", Name: "value"}, + {Type: "unsigned long", Name: "size"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -4722,10 +4722,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, - {Type: "const void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, + {Type: "void*", Name: "value"}, + {Type: "unsigned long", Name: "size"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -4750,9 +4750,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "name"}, - {Type: "const void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "char*", Name: "name"}, + {Type: "void*", Name: "value"}, + {Type: "unsigned long", Name: "size"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -4776,10 +4776,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, {Type: "void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4802,10 +4802,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, {Type: "void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4829,9 +4829,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, {Type: "void*", Name: "value"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4854,9 +4854,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, {Type: "char*", Name: "list"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4879,9 +4879,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, {Type: "char*", Name: "list"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4906,7 +4906,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "char*", Name: "list"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4929,8 +4929,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4953,8 +4953,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "name"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -4978,7 +4978,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5025,7 +5025,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_tod"}, params: []trace.ArgMeta{ - {Type: "time_t*", Name: "tloc"}, + {Type: "void*", Name: "tloc"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5051,7 +5051,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int*", Name: "uaddr"}, {Type: "int", Name: "futex_op"}, {Type: "int", Name: "val"}, - {Type: "const struct timespec*", Name: "timeout"}, + {Type: "struct timespec*", Name: "timeout"}, {Type: "int*", Name: "uaddr2"}, {Type: "int", Name: "val3"}, }, @@ -5076,8 +5076,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "size_t", Name: "cpusetsize"}, + {Type: "int", Name: "pid"}, + {Type: "unsigned long", Name: "cpusetsize"}, {Type: "unsigned long*", Name: "mask"}, }, dependencies: Dependencies{ @@ -5101,8 +5101,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "size_t", Name: "cpusetsize"}, + {Type: "int", Name: "pid"}, + {Type: "unsigned long", Name: "cpusetsize"}, {Type: "unsigned long*", Name: "mask"}, }, dependencies: Dependencies{ @@ -5126,7 +5126,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "struct user_desc*", Name: "u_info"}, + {Type: "void*", Name: "u_info"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5173,7 +5173,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_async_io"}, params: []trace.ArgMeta{ - {Type: "io_context_t", Name: "ctx_id"}, + {Type: "void*", Name: "ctx_id"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5196,10 +5196,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_async_io"}, params: []trace.ArgMeta{ - {Type: "io_context_t", Name: "ctx_id"}, + {Type: "void*", Name: "ctx_id"}, {Type: "long", Name: "min_nr"}, {Type: "long", Name: "nr"}, - {Type: "struct io_event*", Name: "events"}, + {Type: "void*", Name: "events"}, {Type: "struct timespec*", Name: "timeout"}, }, dependencies: Dependencies{ @@ -5223,9 +5223,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_async_io"}, params: []trace.ArgMeta{ - {Type: "io_context_t", Name: "ctx_id"}, + {Type: "void*", Name: "ctx_id"}, {Type: "long", Name: "nr"}, - {Type: "struct iocb**", Name: "iocbpp"}, + {Type: "void*", Name: "iocbpp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5248,9 +5248,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_async_io"}, params: []trace.ArgMeta{ - {Type: "io_context_t", Name: "ctx_id"}, - {Type: "struct iocb*", Name: "iocb"}, - {Type: "struct io_event*", Name: "result"}, + {Type: "void*", Name: "ctx_id"}, + {Type: "void*", Name: "iocb"}, + {Type: "void*", Name: "result"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5273,7 +5273,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "struct user_desc*", Name: "u_info"}, + {Type: "void*", Name: "u_info"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5296,9 +5296,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "cookie"}, + {Type: "unsigned long", Name: "cookie"}, {Type: "char*", Name: "buffer"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5387,9 +5387,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, {Type: "int", Name: "prot"}, - {Type: "size_t", Name: "pgoff"}, + {Type: "unsigned long", Name: "pgoff"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -5414,7 +5414,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ {Type: "unsigned int", Name: "fd"}, - {Type: "struct linux_dirent64*", Name: "dirp"}, + {Type: "void*", Name: "dirp"}, {Type: "unsigned int", Name: "count"}, }, dependencies: Dependencies{ @@ -5483,9 +5483,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_sem"}, params: []trace.ArgMeta{ {Type: "int", Name: "semid"}, - {Type: "struct sembuf*", Name: "sops"}, - {Type: "size_t", Name: "nsops"}, - {Type: "const struct timespec*", Name: "timeout"}, + {Type: "void*", Name: "sops"}, + {Type: "unsigned long", Name: "nsops"}, + {Type: "struct timespec*", Name: "timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5509,8 +5509,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "offset"}, - {Type: "size_t", Name: "len"}, + {Type: "long", Name: "offset"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "advice"}, }, dependencies: Dependencies{ @@ -5534,8 +5534,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clockid"}, - {Type: "struct sigevent*", Name: "sevp"}, + {Type: "int", Name: "clockid"}, + {Type: "void*", Name: "sevp"}, {Type: "timer_t*", Name: "timer_id"}, }, dependencies: Dependencies{ @@ -5559,10 +5559,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, + {Type: "int", Name: "timer_id"}, {Type: "int", Name: "flags"}, {Type: "const struct itimerspec*", Name: "new_value"}, - {Type: "struct itimerspec*", Name: "old_value"}, + {Type: "void*", Name: "old_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5585,8 +5585,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, - {Type: "struct itimerspec*", Name: "curr_value"}, + {Type: "int", Name: "timer_id"}, + {Type: "void*", Name: "curr_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5609,7 +5609,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, + {Type: "int", Name: "timer_id"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5632,7 +5632,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, + {Type: "int", Name: "timer_id"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5655,8 +5655,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clockid"}, - {Type: "const struct timespec*", Name: "tp"}, + {Type: "int", Name: "clockid"}, + {Type: "struct timespec*", Name: "tp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5679,7 +5679,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clockid"}, + {Type: "int", Name: "clockid"}, {Type: "struct timespec*", Name: "tp"}, }, dependencies: Dependencies{ @@ -5703,7 +5703,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clockid"}, + {Type: "int", Name: "clockid"}, {Type: "struct timespec*", Name: "res"}, }, dependencies: Dependencies{ @@ -5727,9 +5727,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clockid"}, + {Type: "int", Name: "clockid"}, {Type: "int", Name: "flags"}, - {Type: "const struct timespec*", Name: "request"}, + {Type: "struct timespec*", Name: "request"}, {Type: "struct timespec*", Name: "remain"}, }, dependencies: Dependencies{ @@ -5777,7 +5777,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ {Type: "int", Name: "epfd"}, - {Type: "struct epoll_event*", Name: "events"}, + {Type: "void*", Name: "events"}, {Type: "int", Name: "maxevents"}, {Type: "int", Name: "timeout"}, }, @@ -5805,7 +5805,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "epfd"}, {Type: "int", Name: "op"}, {Type: "int", Name: "fd"}, - {Type: "struct epoll_event*", Name: "event"}, + {Type: "void*", Name: "event"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5854,7 +5854,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "char*", Name: "filename"}, - {Type: "struct timeval*", Name: "times"}, + {Type: "void*", Name: "times"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -5978,10 +5978,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, {Type: "int", Name: "oflag"}, - {Type: "mode_t", Name: "mode"}, - {Type: "struct mq_attr*", Name: "attr"}, + {Type: "unsigned int", Name: "mode"}, + {Type: "void*", Name: "attr"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6004,7 +6004,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6027,11 +6027,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, - {Type: "const char*", Name: "msg_ptr"}, - {Type: "size_t", Name: "msg_len"}, + {Type: "int", Name: "mqdes"}, + {Type: "char*", Name: "msg_ptr"}, + {Type: "unsigned long", Name: "msg_len"}, {Type: "unsigned int", Name: "msg_prio"}, - {Type: "const struct timespec*", Name: "abs_timeout"}, + {Type: "struct timespec*", Name: "abs_timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6054,11 +6054,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, + {Type: "int", Name: "mqdes"}, {Type: "char*", Name: "msg_ptr"}, - {Type: "size_t", Name: "msg_len"}, + {Type: "unsigned long", Name: "msg_len"}, {Type: "unsigned int*", Name: "msg_prio"}, - {Type: "const struct timespec*", Name: "abs_timeout"}, + {Type: "struct timespec*", Name: "abs_timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6081,7 +6081,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, + {Type: "int", Name: "mqdes"}, {Type: "const struct sigevent*", Name: "sevp"}, }, dependencies: Dependencies{ @@ -6105,9 +6105,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_msgq"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, - {Type: "const struct mq_attr*", Name: "newattr"}, - {Type: "struct mq_attr*", Name: "oldattr"}, + {Type: "int", Name: "mqdes"}, + {Type: "void*", Name: "newattr"}, + {Type: "void*", Name: "oldattr"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6132,7 +6132,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "unsigned long", Name: "entry"}, {Type: "unsigned long", Name: "nr_segments"}, - {Type: "struct kexec_segment*", Name: "segments"}, + {Type: "void*", Name: "segments"}, {Type: "unsigned long", Name: "flags"}, }, dependencies: Dependencies{ @@ -6157,10 +6157,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_life"}, params: []trace.ArgMeta{ {Type: "int", Name: "idtype"}, - {Type: "pid_t", Name: "id"}, - {Type: "struct siginfo*", Name: "infop"}, + {Type: "int", Name: "id"}, + {Type: "void*", Name: "infop"}, {Type: "int", Name: "options"}, - {Type: "struct rusage*", Name: "rusage"}, + {Type: "void*", Name: "rusage"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6183,11 +6183,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system", "system_keys"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "type"}, - {Type: "const char*", Name: "description"}, - {Type: "const void*", Name: "payload"}, - {Type: "size_t", Name: "plen"}, - {Type: "key_serial_t", Name: "keyring"}, + {Type: "char*", Name: "type"}, + {Type: "char*", Name: "description"}, + {Type: "void*", Name: "payload"}, + {Type: "unsigned long", Name: "plen"}, + {Type: "int", Name: "keyring"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6210,10 +6210,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system", "system_keys"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "type"}, - {Type: "const char*", Name: "description"}, - {Type: "const char*", Name: "callout_info"}, - {Type: "key_serial_t", Name: "dest_keyring"}, + {Type: "char*", Name: "type"}, + {Type: "char*", Name: "description"}, + {Type: "char*", Name: "callout_info"}, + {Type: "int", Name: "dest_keyring"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6334,8 +6334,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_monitor"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "u32", Name: "mask"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mask"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6409,9 +6409,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, - {Type: "mode_t", Name: "mode"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6435,8 +6435,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_dir_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6460,9 +6460,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, + {Type: "unsigned int", Name: "dev"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6486,9 +6486,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "uid_t", Name: "owner"}, - {Type: "gid_t", Name: "group"}, + {Type: "char*", Name: "pathname"}, + {Type: "int", Name: "owner"}, + {Type: "int", Name: "group"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6513,8 +6513,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "struct timeval*", Name: "times"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "times"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6538,8 +6538,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6564,7 +6564,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6589,9 +6589,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "olddirfd"}, - {Type: "const char*", Name: "oldpath"}, + {Type: "char*", Name: "oldpath"}, {Type: "int", Name: "newdirfd"}, - {Type: "const char*", Name: "newpath"}, + {Type: "char*", Name: "newpath"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6615,9 +6615,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "olddirfd"}, - {Type: "const char*", Name: "oldpath"}, + {Type: "char*", Name: "oldpath"}, {Type: "int", Name: "newdirfd"}, - {Type: "const char*", Name: "newpath"}, + {Type: "char*", Name: "newpath"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6641,9 +6641,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "target"}, + {Type: "char*", Name: "target"}, {Type: "int", Name: "newdirfd"}, - {Type: "const char*", Name: "linkpath"}, + {Type: "char*", Name: "linkpath"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6667,7 +6667,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_link_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "char*", Name: "buf"}, {Type: "int", Name: "bufsiz"}, }, @@ -6693,8 +6693,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "mode"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6719,7 +6719,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "mode"}, {Type: "int", Name: "flags"}, }, @@ -6745,9 +6745,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ {Type: "int", Name: "nfds"}, - {Type: "fd_set*", Name: "readfds"}, - {Type: "fd_set*", Name: "writefds"}, - {Type: "fd_set*", Name: "exceptfds"}, + {Type: "void*", Name: "readfds"}, + {Type: "void*", Name: "writefds"}, + {Type: "void*", Name: "exceptfds"}, {Type: "struct timespec*", Name: "timeout"}, {Type: "void*", Name: "sigmask"}, }, @@ -6772,11 +6772,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ - {Type: "struct pollfd*", Name: "fds"}, + {Type: "void*", Name: "fds"}, {Type: "unsigned int", Name: "nfds"}, {Type: "struct timespec*", Name: "tmo_p"}, {Type: "const sigset_t*", Name: "sigmask"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6822,8 +6822,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "ipc", "ipc_futex"}, params: []trace.ArgMeta{ - {Type: "struct robust_list_head*", Name: "head"}, - {Type: "size_t", Name: "len"}, + {Type: "void*", Name: "head"}, + {Type: "unsigned long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -6847,7 +6847,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_futex"}, params: []trace.ArgMeta{ {Type: "int", Name: "pid"}, - {Type: "struct robust_list_head**", Name: "head_ptr"}, + {Type: "void*", Name: "head_ptr"}, {Type: "size_t*", Name: "len_ptr"}, }, dependencies: Dependencies{ @@ -6875,7 +6875,7 @@ var CoreEvents = map[ID]Definition{ {Type: "off_t*", Name: "off_in"}, {Type: "int", Name: "fd_out"}, {Type: "off_t*", Name: "off_out"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6901,7 +6901,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd_in"}, {Type: "int", Name: "fd_out"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6926,8 +6926,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_sync"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "offset"}, - {Type: "off_t", Name: "nbytes"}, + {Type: "long", Name: "offset"}, + {Type: "long", Name: "nbytes"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -6952,7 +6952,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "ipc", "ipc_pipe"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "unsigned long", Name: "nr_segs"}, {Type: "unsigned int", Name: "flags"}, }, @@ -7006,7 +7006,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "struct timespec*", Name: "times"}, {Type: "int", Name: "flags"}, }, @@ -7032,11 +7032,11 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ {Type: "int", Name: "epfd"}, - {Type: "struct epoll_event*", Name: "events"}, + {Type: "void*", Name: "events"}, {Type: "int", Name: "maxevents"}, {Type: "int", Name: "timeout"}, {Type: "const sigset_t*", Name: "sigmask"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7060,7 +7060,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "sigset_t*", Name: "mask"}, + {Type: "void*", Name: "mask"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7134,8 +7134,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "int", Name: "mode"}, - {Type: "off_t", Name: "offset"}, - {Type: "off_t", Name: "len"}, + {Type: "long", Name: "offset"}, + {Type: "long", Name: "len"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7161,7 +7161,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "fd"}, {Type: "int", Name: "flags"}, {Type: "const struct itimerspec*", Name: "new_value"}, - {Type: "struct itimerspec*", Name: "old_value"}, + {Type: "void*", Name: "old_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7185,7 +7185,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "time", "time_timer"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct itimerspec*", Name: "curr_value"}, + {Type: "void*", Name: "curr_value"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7236,7 +7236,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, {Type: "const sigset_t*", Name: "mask"}, - {Type: "size_t", Name: "sizemask"}, + {Type: "unsigned long", Name: "sizemask"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7374,7 +7374,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}, @@ -7401,7 +7401,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}, @@ -7427,8 +7427,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "signals"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "tgid"}, - {Type: "pid_t", Name: "tid"}, + {Type: "int", Name: "tgid"}, + {Type: "int", Name: "tid"}, {Type: "int", Name: "sig"}, {Type: "siginfo_t*", Name: "info"}, }, @@ -7453,8 +7453,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "system"}, params: []trace.ArgMeta{ - {Type: "struct perf_event_attr*", Name: "attr"}, - {Type: "pid_t", Name: "pid"}, + {Type: "void*", Name: "attr"}, + {Type: "int", Name: "pid"}, {Type: "int", Name: "cpu"}, {Type: "int", Name: "group_fd"}, {Type: "unsigned long", Name: "flags"}, @@ -7481,7 +7481,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "net", "net_snd_rcv"}, params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, - {Type: "struct mmsghdr*", Name: "msgvec"}, + {Type: "void*", Name: "msgvec"}, {Type: "unsigned int", Name: "vlen"}, {Type: "int", Name: "flags"}, {Type: "struct timespec*", Name: "timeout"}, @@ -7533,9 +7533,9 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "fanotify_fd"}, {Type: "unsigned int", Name: "flags"}, - {Type: "u64", Name: "mask"}, + {Type: "unsigned long", Name: "mask"}, {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7558,10 +7558,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "int", Name: "resource"}, - {Type: "const struct rlimit64*", Name: "new_limit"}, - {Type: "struct rlimit64*", Name: "old_limit"}, + {Type: "void*", Name: "new_limit"}, + {Type: "void*", Name: "old_limit"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7585,8 +7585,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "struct file_handle*", Name: "handle"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "handle"}, {Type: "int*", Name: "mount_id"}, {Type: "int", Name: "flags"}, }, @@ -7612,7 +7612,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "mount_fd"}, - {Type: "struct file_handle*", Name: "handle"}, + {Type: "void*", Name: "handle"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7636,8 +7636,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "time", "time_clock"}, params: []trace.ArgMeta{ - {Type: "const clockid_t", Name: "clk_id"}, - {Type: "struct timex*", Name: "buf"}, + {Type: "int", Name: "clk_id"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7684,7 +7684,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "net", "net_snd_rcv"}, params: []trace.ArgMeta{ {Type: "int", Name: "sockfd"}, - {Type: "struct mmsghdr*", Name: "msgvec"}, + {Type: "void*", Name: "msgvec"}, {Type: "unsigned int", Name: "vlen"}, {Type: "int", Name: "flags"}, }, @@ -7735,7 +7735,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "unsigned int*", Name: "cpu"}, {Type: "unsigned int*", Name: "node"}, - {Type: "struct getcpu_cache*", Name: "tcache"}, + {Type: "void*", Name: "tcache"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7758,10 +7758,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "const struct iovec*", Name: "local_iov"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "local_iov"}, {Type: "unsigned long", Name: "liovcnt"}, - {Type: "const struct iovec*", Name: "remote_iov"}, + {Type: "void*", Name: "remote_iov"}, {Type: "unsigned long", Name: "riovcnt"}, {Type: "unsigned long", Name: "flags"}, }, @@ -7786,10 +7786,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "const struct iovec*", Name: "local_iov"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "local_iov"}, {Type: "unsigned long", Name: "liovcnt"}, - {Type: "const struct iovec*", Name: "remote_iov"}, + {Type: "void*", Name: "remote_iov"}, {Type: "unsigned long", Name: "riovcnt"}, {Type: "unsigned long", Name: "flags"}, }, @@ -7808,8 +7808,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid1"}, - {Type: "pid_t", Name: "pid2"}, + {Type: "int", Name: "pid1"}, + {Type: "int", Name: "pid2"}, {Type: "int", Name: "type"}, {Type: "unsigned long", Name: "idx1"}, {Type: "unsigned long", Name: "idx2"}, @@ -7836,7 +7836,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "system", "system_module"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "param_values"}, + {Type: "char*", Name: "param_values"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7860,8 +7860,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "struct sched_attr*", Name: "attr"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "attr"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7885,8 +7885,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_sched"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "struct sched_attr*", Name: "attr"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "attr"}, {Type: "unsigned int", Name: "size"}, {Type: "unsigned int", Name: "flags"}, }, @@ -7912,9 +7912,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "olddirfd"}, - {Type: "const char*", Name: "oldpath"}, + {Type: "char*", Name: "oldpath"}, {Type: "int", Name: "newdirfd"}, - {Type: "const char*", Name: "newpath"}, + {Type: "char*", Name: "newpath"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7940,7 +7940,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "unsigned int", Name: "operation"}, {Type: "unsigned int", Name: "flags"}, - {Type: "const void*", Name: "args"}, + {Type: "void*", Name: "args"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -7964,7 +7964,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ {Type: "void*", Name: "buf"}, - {Type: "size_t", Name: "buflen"}, + {Type: "unsigned long", Name: "buflen"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -7988,7 +7988,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"default", "syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8015,7 +8015,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "kernel_fd"}, {Type: "int", Name: "initrd_fd"}, {Type: "unsigned long", Name: "cmdline_len"}, - {Type: "const char*", Name: "cmdline"}, + {Type: "char*", Name: "cmdline"}, {Type: "unsigned long", Name: "flags"}, }, dependencies: Dependencies{ @@ -8065,7 +8065,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_life"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "const char*const*", Name: "argv"}, {Type: "const char*const*", Name: "envp"}, {Type: "int", Name: "flags"}, @@ -8140,8 +8140,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "void*", Name: "addr"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8169,7 +8169,7 @@ var CoreEvents = map[ID]Definition{ {Type: "off_t*", Name: "off_in"}, {Type: "int", Name: "fd_out"}, {Type: "off_t*", Name: "off_out"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8194,7 +8194,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}, @@ -8222,7 +8222,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_read_write"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const struct iovec*", Name: "iov"}, + {Type: "void*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}, @@ -8250,7 +8250,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "prot"}, {Type: "int", Name: "pkey"}, }, @@ -8323,10 +8323,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, {Type: "unsigned int", Name: "mask"}, - {Type: "struct statx*", Name: "statxbuf"}, + {Type: "void*", Name: "statxbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8352,7 +8352,7 @@ var CoreEvents = map[ID]Definition{ {Type: "aio_context_t", Name: "ctx_id"}, {Type: "long", Name: "min_nr"}, {Type: "long", Name: "nr"}, - {Type: "struct io_event*", Name: "events"}, + {Type: "void*", Name: "events"}, {Type: "struct timespec*", Name: "timeout"}, {Type: "const struct __aio_sigset*", Name: "usig"}, }, @@ -8377,10 +8377,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls"}, params: []trace.ArgMeta{ - {Type: "struct rseq*", Name: "rseq"}, - {Type: "u32", Name: "rseq_len"}, + {Type: "void*", Name: "rseq"}, + {Type: "unsigned int", Name: "rseq_len"}, {Type: "int", Name: "flags"}, - {Type: "u32", Name: "sig"}, + {Type: "unsigned int", Name: "sig"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8430,7 +8430,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls"}, params: []trace.ArgMeta{ {Type: "unsigned int", Name: "entries"}, - {Type: "struct io_uring_params*", Name: "p"}, + {Type: "void*", Name: "p"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8457,7 +8457,7 @@ var CoreEvents = map[ID]Definition{ {Type: "unsigned int", Name: "to_submit"}, {Type: "unsigned int", Name: "min_complete"}, {Type: "unsigned int", Name: "flags"}, - {Type: "sigset_t*", Name: "sig"}, + {Type: "void*", Name: "sig"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8507,7 +8507,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls"}, params: []trace.ArgMeta{ {Type: "int", Name: "dfd"}, - {Type: "const char*", Name: "filename"}, + {Type: "char*", Name: "filename"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8532,9 +8532,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"default", "syscalls", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "from_dfd"}, - {Type: "const char*", Name: "from_path"}, + {Type: "char*", Name: "from_path"}, {Type: "int", Name: "to_dfd"}, - {Type: "const char*", Name: "to_path"}, + {Type: "char*", Name: "to_path"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8558,7 +8558,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "fsname"}, + {Type: "char*", Name: "fsname"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8584,8 +8584,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int*", Name: "fs_fd"}, {Type: "unsigned int", Name: "cmd"}, - {Type: "const char*", Name: "key"}, - {Type: "const void*", Name: "value"}, + {Type: "char*", Name: "key"}, + {Type: "void*", Name: "value"}, {Type: "int", Name: "aux"}, }, dependencies: Dependencies{ @@ -8635,7 +8635,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8659,7 +8659,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ @@ -8683,8 +8683,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "proc_life"}, params: []trace.ArgMeta{ - {Type: "struct clone_args*", Name: "cl_args"}, - {Type: "size_t", Name: "size"}, + {Type: "void*", Name: "cl_args"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8732,9 +8732,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, - {Type: "const char*", Name: "pathname"}, - {Type: "struct open_how*", Name: "how"}, - {Type: "size_t", Name: "size"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "how"}, + {Type: "unsigned long", Name: "size"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8783,7 +8783,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_file_attr"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "path"}, {Type: "int", Name: "mode"}, {Type: "int", Name: "flag"}, }, @@ -8810,7 +8810,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "pidfd"}, {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "length"}, + {Type: "unsigned long", Name: "length"}, {Type: "int", Name: "advice"}, {Type: "unsigned long", Name: "flags"}, }, @@ -8836,9 +8836,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "fs", "fs_mux_io"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct epoll_event*", Name: "events"}, + {Type: "void*", Name: "events"}, {Type: "int", Name: "maxevents"}, - {Type: "const struct timespec*", Name: "timeout"}, + {Type: "struct timespec*", Name: "timeout"}, {Type: "const sigset_t*", Name: "sigset"}, }, dependencies: Dependencies{ @@ -8865,8 +8865,8 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "dfd"}, {Type: "char*", Name: "path"}, {Type: "unsigned int", Name: "flags"}, - {Type: "struct mount_attr*", Name: "uattr"}, - {Type: "size_t", Name: "usize"}, + {Type: "void*", Name: "uattr"}, + {Type: "unsigned long", Name: "usize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8915,9 +8915,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "proc", "fs"}, params: []trace.ArgMeta{ - {Type: "struct landlock_ruleset_attr*", Name: "attr"}, - {Type: "size_t", Name: "size"}, - {Type: "u32", Name: "flags"}, + {Type: "void*", Name: "attr"}, + {Type: "unsigned long", Name: "size"}, + {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8941,9 +8941,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "ruleset_fd"}, - {Type: "landlock_rule_type", Name: "rule_type"}, + {Type: "int", Name: "rule_type"}, {Type: "void*", Name: "rule_attr"}, - {Type: "u32", Name: "flags"}, + {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -8967,7 +8967,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "proc", "fs"}, params: []trace.ArgMeta{ {Type: "int", Name: "ruleset_fd"}, - {Type: "u32", Name: "flags"}, + {Type: "unsigned int", Name: "flags"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9037,7 +9037,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, + {Type: "int", Name: "pid"}, {Type: "int*", Name: "status"}, {Type: "int", Name: "options"}, }, @@ -9105,7 +9105,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "char*", Name: "filename"}, - {Type: "struct __old_kernel_stat*", Name: "statbuf"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9128,7 +9128,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "target"}, + {Type: "char*", Name: "target"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9282,7 +9282,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "signum"}, - {Type: "sighandler_t", Name: "handler"}, + {Type: "void*", Name: "handler"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9368,7 +9368,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "struct oldold_utsname*", Name: "name"}, + {Type: "void*", Name: "name"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9392,8 +9392,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "sig"}, - {Type: "const struct sigaction*", Name: "act"}, - {Type: "struct sigaction*", Name: "oact"}, + {Type: "void*", Name: "act"}, + {Type: "void*", Name: "oact"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9483,7 +9483,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "sigset_t*", Name: "set"}, + {Type: "void*", Name: "set"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9506,8 +9506,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9531,7 +9531,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "unsigned int", Name: "fd"}, - {Type: "struct old_linux_dirent*", Name: "dirp"}, + {Type: "void*", Name: "dirp"}, {Type: "unsigned int", Name: "count"}, }, dependencies: Dependencies{ @@ -9600,7 +9600,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "struct utsname*", Name: "buf"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9644,7 +9644,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "struct vm86_struct*", Name: "info"}, + {Type: "void*", Name: "info"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9811,10 +9811,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "nfds"}, - {Type: "fd_set*", Name: "readfds"}, - {Type: "fd_set*", Name: "writefds"}, - {Type: "fd_set*", Name: "exceptfds"}, - {Type: "struct timeval*", Name: "timeout"}, + {Type: "void*", Name: "readfds"}, + {Type: "void*", Name: "writefds"}, + {Type: "void*", Name: "exceptfds"}, + {Type: "void*", Name: "timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9838,7 +9838,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "unsigned long", Name: "fn"}, - {Type: "struct vm86plus_struct*", Name: "v86"}, + {Type: "void*", Name: "v86"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9862,7 +9862,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "resource"}, - {Type: "struct rlimit*", Name: "rlim"}, + {Type: "void*", Name: "rlim"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9913,8 +9913,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "off_t", Name: "length"}, + {Type: "char*", Name: "path"}, + {Type: "long", Name: "length"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9938,7 +9938,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "off_t", Name: "length"}, + {Type: "long", Name: "length"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9961,8 +9961,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat64*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -9985,8 +9985,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "struct stat64*", Name: "statbuf"}, + {Type: "char*", Name: "pathname"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10010,7 +10010,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct stat64*", Name: "statbuf"}, + {Type: "void*", Name: "statbuf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10033,9 +10033,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "old_uid_t", Name: "owner"}, - {Type: "old_gid_t", Name: "group"}, + {Type: "char*", Name: "pathname"}, + {Type: "u16", Name: "owner"}, + {Type: "u16", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10142,8 +10142,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_uid_t", Name: "ruid"}, - {Type: "old_uid_t", Name: "euid"}, + {Type: "u16", Name: "ruid"}, + {Type: "u16", Name: "euid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10166,8 +10166,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_gid_t", Name: "rgid"}, - {Type: "old_gid_t", Name: "egid"}, + {Type: "u16", Name: "rgid"}, + {Type: "u16", Name: "egid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10214,7 +10214,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "size_t", Name: "size"}, + {Type: "unsigned long", Name: "size"}, {Type: "const gid_t*", Name: "list"}, }, dependencies: Dependencies{ @@ -10239,8 +10239,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "unsigned int", Name: "fd"}, - {Type: "old_uid_t", Name: "user"}, - {Type: "old_gid_t", Name: "group"}, + {Type: "u16", Name: "user"}, + {Type: "u16", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10263,9 +10263,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_uid_t", Name: "ruid"}, - {Type: "old_uid_t", Name: "euid"}, - {Type: "old_uid_t", Name: "suid"}, + {Type: "u16", Name: "ruid"}, + {Type: "u16", Name: "euid"}, + {Type: "u16", Name: "suid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10313,9 +10313,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_uid_t", Name: "rgid"}, - {Type: "old_uid_t", Name: "euid"}, - {Type: "old_uid_t", Name: "suid"}, + {Type: "u16", Name: "rgid"}, + {Type: "u16", Name: "euid"}, + {Type: "u16", Name: "suid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10363,9 +10363,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "old_uid_t", Name: "owner"}, - {Type: "old_gid_t", Name: "group"}, + {Type: "char*", Name: "pathname"}, + {Type: "u16", Name: "owner"}, + {Type: "u16", Name: "group"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10388,7 +10388,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_uid_t", Name: "uid"}, + {Type: "u16", Name: "uid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10411,7 +10411,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_gid_t", Name: "gid"}, + {Type: "u16", Name: "gid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10434,7 +10434,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_uid_t", Name: "fsuid"}, + {Type: "u16", Name: "fsuid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10457,7 +10457,7 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "old_gid_t", Name: "fsgid"}, + {Type: "u16", Name: "fsgid"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10508,7 +10508,7 @@ var CoreEvents = map[ID]Definition{ {Type: "int", Name: "out_fd"}, {Type: "int", Name: "in_fd"}, {Type: "off_t*", Name: "offset"}, - {Type: "size_t", Name: "count"}, + {Type: "unsigned long", Name: "count"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10531,9 +10531,9 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "path"}, - {Type: "size_t", Name: "sz"}, - {Type: "struct statfs64*", Name: "buf"}, + {Type: "char*", Name: "path"}, + {Type: "unsigned long", Name: "sz"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10557,8 +10557,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "size_t", Name: "sz"}, - {Type: "struct statfs64*", Name: "buf"}, + {Type: "unsigned long", Name: "sz"}, + {Type: "void*", Name: "buf"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10582,8 +10582,8 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "loff_t", Name: "offset"}, - {Type: "loff_t", Name: "len"}, + {Type: "unsigned long", Name: "offset"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "advice"}, }, dependencies: Dependencies{ @@ -10607,8 +10607,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "clockid_t", Name: "which_clock"}, - {Type: "struct old_timespec32*", Name: "tp"}, + {Type: "int", Name: "which_clock"}, + {Type: "void*", Name: "tp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10631,8 +10631,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "clockid_t", Name: "which_clock"}, - {Type: "struct old_timespec32*", Name: "tp"}, + {Type: "int", Name: "which_clock"}, + {Type: "void*", Name: "tp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10676,8 +10676,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "clockid_t", Name: "which_clock"}, - {Type: "struct old_timespec32*", Name: "tp"}, + {Type: "int", Name: "which_clock"}, + {Type: "void*", Name: "tp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10700,10 +10700,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "clockid_t", Name: "which_clock"}, + {Type: "int", Name: "which_clock"}, {Type: "int", Name: "flags"}, - {Type: "struct old_timespec32*", Name: "rqtp"}, - {Type: "struct old_timespec32*", Name: "rmtp"}, + {Type: "void*", Name: "rqtp"}, + {Type: "void*", Name: "rmtp"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10726,8 +10726,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, - {Type: "struct old_itimerspec32*", Name: "setting"}, + {Type: "int", Name: "timer_id"}, + {Type: "void*", Name: "setting"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10750,10 +10750,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "timer_t", Name: "timer_id"}, + {Type: "int", Name: "timer_id"}, {Type: "int", Name: "flags"}, - {Type: "struct old_itimerspec32*", Name: "new"}, - {Type: "struct old_itimerspec32*", Name: "old"}, + {Type: "void*", Name: "new"}, + {Type: "void*", Name: "old"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10777,7 +10777,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "ufd"}, - {Type: "struct old_itimerspec32*", Name: "otmr"}, + {Type: "void*", Name: "otmr"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10802,8 +10802,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "ufd"}, {Type: "int", Name: "flags"}, - {Type: "struct old_itimerspec32*", Name: "utmr"}, - {Type: "struct old_itimerspec32*", Name: "otmr"}, + {Type: "void*", Name: "utmr"}, + {Type: "void*", Name: "otmr"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10828,7 +10828,7 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "unsigned int", Name: "dfd"}, {Type: "char*", Name: "filename"}, - {Type: "struct old_timespec32*", Name: "t"}, + {Type: "void*", Name: "t"}, {Type: "int", Name: "flags"}, }, dependencies: Dependencies{ @@ -10853,10 +10853,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "n"}, - {Type: "fd_set*", Name: "inp"}, - {Type: "fd_set*", Name: "outp"}, - {Type: "fd_set*", Name: "exp"}, - {Type: "struct old_timespec32*", Name: "tsp"}, + {Type: "void*", Name: "inp"}, + {Type: "void*", Name: "outp"}, + {Type: "void*", Name: "exp"}, + {Type: "void*", Name: "tsp"}, {Type: "void*", Name: "sig"}, }, dependencies: Dependencies{ @@ -10880,11 +10880,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "struct pollfd*", Name: "ufds"}, + {Type: "void*", Name: "ufds"}, {Type: "unsigned int", Name: "nfds"}, - {Type: "struct old_timespec32*", Name: "tsp"}, - {Type: "sigset_t*", Name: "sigmask"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "tsp"}, + {Type: "void*", Name: "sigmask"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10929,10 +10929,10 @@ var CoreEvents = map[ID]Definition{ sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ {Type: "int", Name: "fd"}, - {Type: "struct mmsghdr*", Name: "mmsg"}, + {Type: "void*", Name: "mmsg"}, {Type: "unsigned int", Name: "vlen"}, {Type: "unsigned int", Name: "flags"}, - {Type: "struct old_timespec32*", Name: "timeout"}, + {Type: "void*", Name: "timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10955,11 +10955,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, + {Type: "int", Name: "mqdes"}, {Type: "char*", Name: "u_msg_ptr"}, {Type: "unsigned int", Name: "msg_len"}, {Type: "unsigned int", Name: "msg_prio"}, - {Type: "struct old_timespec32*", Name: "u_abs_timeout"}, + {Type: "void*", Name: "u_abs_timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -10982,11 +10982,11 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "mqd_t", Name: "mqdes"}, + {Type: "int", Name: "mqdes"}, {Type: "char*", Name: "u_msg_ptr"}, {Type: "unsigned int", Name: "msg_len"}, {Type: "unsigned int*", Name: "u_msg_prio"}, - {Type: "struct old_timespec32*", Name: "u_abs_timeout"}, + {Type: "void*", Name: "u_abs_timeout"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -11009,10 +11009,10 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "sigset_t*", Name: "uthese"}, + {Type: "void*", Name: "uthese"}, {Type: "siginfo_t*", Name: "uinfo"}, - {Type: "struct old_timespec32*", Name: "uts"}, - {Type: "size_t", Name: "sigsetsize"}, + {Type: "void*", Name: "uts"}, + {Type: "unsigned long", Name: "sigsetsize"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -11037,10 +11037,10 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "u32*", Name: "uaddr"}, {Type: "int", Name: "op"}, - {Type: "u32", Name: "val"}, - {Type: "struct old_timespec32*", Name: "utime"}, + {Type: "unsigned int", Name: "val"}, + {Type: "void*", Name: "utime"}, {Type: "u32*", Name: "uaddr2"}, - {Type: "u32", Name: "val3"}, + {Type: "unsigned int", Name: "val3"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -11063,8 +11063,8 @@ var CoreEvents = map[ID]Definition{ syscall: true, sets: []string{"syscalls", "32bit_unique"}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "struct old_timespec32*", Name: "interval"}, + {Type: "int", Name: "pid"}, + {Type: "void*", Name: "interval"}, }, dependencies: Dependencies{ probes: []Probe{ @@ -11178,22 +11178,22 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "proc"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "cmdpath"}, - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "cmdpath"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, - {Type: "umode_t", Name: "inode_mode"}, - {Type: "const char*", Name: "interpreter_pathname"}, - {Type: "dev_t", Name: "interpreter_dev"}, + {Type: "u16", Name: "inode_mode"}, + {Type: "char*", Name: "interpreter_pathname"}, + {Type: "unsigned int", Name: "interpreter_dev"}, {Type: "unsigned long", Name: "interpreter_inode"}, {Type: "unsigned long", Name: "interpreter_ctime"}, {Type: "const char**", Name: "argv"}, - {Type: "const char*", Name: "interp"}, - {Type: "umode_t", Name: "stdin_type"}, + {Type: "char*", Name: "interp"}, + {Type: "u16", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "invoked_from_kernel"}, - {Type: "const char*", Name: "prev_comm"}, + {Type: "char*", Name: "prev_comm"}, {Type: "const char**", Name: "env"}, }, }, @@ -11231,9 +11231,9 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "cpu"}, {Type: "int", Name: "prev_tid"}, - {Type: "const char*", Name: "prev_comm"}, + {Type: "char*", Name: "prev_comm"}, {Type: "int", Name: "next_tid"}, - {Type: "const char*", Name: "next_comm"}, + {Type: "char*", Name: "next_comm"}, }, }, DoExit: { @@ -11275,11 +11275,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "size_t", Name: "count"}, - {Type: "off_t", Name: "pos"}, + {Type: "unsigned long", Name: "count"}, + {Type: "long", Name: "pos"}, }, }, VfsWritev: { @@ -11295,11 +11295,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "vlen"}, - {Type: "off_t", Name: "pos"}, + {Type: "long", Name: "pos"}, }, }, MemProtAlert: { @@ -11315,15 +11315,15 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "u32", Name: "alert"}, + {Type: "unsigned int", Name: "alert"}, {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "prot"}, {Type: "int", Name: "prev_prot"}, - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "u64", Name: "ctime"}, + {Type: "unsigned long", Name: "ctime"}, }, }, CommitCreds: { @@ -11354,13 +11354,13 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "pid_t", Name: "pid"}, - {Type: "u32", Name: "new_mnt"}, - {Type: "u32", Name: "new_pid"}, - {Type: "u32", Name: "new_uts"}, - {Type: "u32", Name: "new_ipc"}, - {Type: "u32", Name: "new_net"}, - {Type: "u32", Name: "new_cgroup"}, + {Type: "int", Name: "pid"}, + {Type: "unsigned int", Name: "new_mnt"}, + {Type: "unsigned int", Name: "new_pid"}, + {Type: "unsigned int", Name: "new_uts"}, + {Type: "unsigned int", Name: "new_ipc"}, + {Type: "unsigned int", Name: "new_net"}, + {Type: "unsigned int", Name: "new_cgroup"}, }, }, MagicWrite: { @@ -11381,9 +11381,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "bytes", Name: "bytes"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, }, }, @@ -11399,9 +11399,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "cgroup_path"}, - {Type: "const char*", Name: "comm"}, - {Type: "pid_t", Name: "pid"}, + {Type: "char*", Name: "cgroup_path"}, + {Type: "char*", Name: "comm"}, + {Type: "int", Name: "pid"}, }, }, CgroupMkdir: { @@ -11416,9 +11416,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "u64", Name: "cgroup_id"}, - {Type: "const char*", Name: "cgroup_path"}, - {Type: "u32", Name: "hierarchy_id"}, + {Type: "unsigned long", Name: "cgroup_id"}, + {Type: "char*", Name: "cgroup_path"}, + {Type: "unsigned int", Name: "hierarchy_id"}, }, }, CgroupRmdir: { @@ -11433,9 +11433,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "u64", Name: "cgroup_id"}, - {Type: "const char*", Name: "cgroup_path"}, - {Type: "u32", Name: "hierarchy_id"}, + {Type: "unsigned long", Name: "cgroup_id"}, + {Type: "char*", Name: "cgroup_path"}, + {Type: "unsigned int", Name: "hierarchy_id"}, }, }, SecurityBprmCheck: { @@ -11460,8 +11460,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "proc", "proc_life"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "const char*const*", Name: "argv"}, {Type: "const char*const*", Name: "envp"}, @@ -11479,12 +11479,12 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, - {Type: "const char*", Name: "syscall_pathname"}, + {Type: "char*", Name: "syscall_pathname"}, }, }, SecurityInodeUnlink: { @@ -11499,10 +11499,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "lsm_hooks", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned long", Name: "inode"}, - {Type: "dev_t", Name: "dev"}, - {Type: "u64", Name: "ctime"}, + {Type: "unsigned int", Name: "dev"}, + {Type: "unsigned long", Name: "ctime"}, }, }, SecuritySocketCreate: { @@ -11573,9 +11573,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "flows"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "dst"}, + {Type: "char*", Name: "dst"}, {Type: "int", Name: "dst_port"}, - {Type: "const char **", Name: "dst_dns"}, + {Type: "const char**", Name: "dst_dns"}, }, }, SecuritySocketAccept: { @@ -11642,9 +11642,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "lsm_hooks", "fs"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "dev_name"}, - {Type: "const char*", Name: "path"}, - {Type: "const char*", Name: "type"}, + {Type: "char*", Name: "dev_name"}, + {Type: "char*", Name: "path"}, + {Type: "char*", Name: "type"}, {Type: "unsigned long", Name: "flags"}, }, }, @@ -11676,7 +11676,7 @@ var CoreEvents = map[ID]Definition{ sets: []string{"lsm_hooks"}, params: []trace.ArgMeta{ {Type: "unsigned int", Name: "map_id"}, - {Type: "const char*", Name: "map_name"}, + {Type: "char*", Name: "map_name"}, }, }, SecurityKernelReadFile: { @@ -11691,8 +11691,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "int", Name: "type"}, {Type: "unsigned long", Name: "ctime"}, @@ -11710,7 +11710,7 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "long", Name: "size"}, {Type: "int", Name: "type"}, }, @@ -11727,9 +11727,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "file_name"}, - {Type: "umode_t", Name: "mode"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "file_name"}, + {Type: "u16", Name: "mode"}, + {Type: "unsigned int", Name: "dev"}, }, }, SecurityInodeSymlinkEventId: { @@ -11744,8 +11744,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "linkpath"}, - {Type: "const char*", Name: "target"}, + {Type: "char*", Name: "linkpath"}, + {Type: "char*", Name: "target"}, }, }, SecurityMmapFile: { @@ -11760,9 +11760,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, {Type: "unsigned long", Name: "prot"}, @@ -11783,9 +11783,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{"fs", "fs_file_ops", "proc", "proc_mem"}, params: []trace.ArgMeta{ {Type: "void*", Name: "addr"}, - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned int", Name: "flags"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, {Type: "unsigned long", Name: "pgoff"}, @@ -11811,12 +11811,12 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "proc", "proc_mem", "fs", "fs_file_ops"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "prot"}, {Type: "unsigned long", Name: "ctime"}, {Type: "int", Name: "prev_prot"}, {Type: "void*", Name: "addr"}, - {Type: "size_t", Name: "len"}, + {Type: "unsigned long", Name: "len"}, {Type: "int", Name: "pkey"}, }, }, @@ -11834,16 +11834,16 @@ var CoreEvents = map[ID]Definition{ }, }, params: []trace.ArgMeta{ - {Type: "u32", Name: "cgroup"}, - {Type: "u32", Name: "ipc"}, - {Type: "u32", Name: "mnt"}, - {Type: "u32", Name: "net"}, - {Type: "u32", Name: "pid"}, - {Type: "u32", Name: "pid_for_children"}, - {Type: "u32", Name: "time"}, - {Type: "u32", Name: "time_for_children"}, - {Type: "u32", Name: "user"}, - {Type: "u32", Name: "uts"}, + {Type: "unsigned int", Name: "cgroup"}, + {Type: "unsigned int", Name: "ipc"}, + {Type: "unsigned int", Name: "mnt"}, + {Type: "unsigned int", Name: "net"}, + {Type: "unsigned int", Name: "pid"}, + {Type: "unsigned int", Name: "pid_for_children"}, + {Type: "unsigned int", Name: "time"}, + {Type: "unsigned int", Name: "time_for_children"}, + {Type: "unsigned int", Name: "user"}, + {Type: "unsigned int", Name: "uts"}, }, }, TraceeInfo: { @@ -11854,9 +11854,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{}, dependencies: Dependencies{}, params: []trace.ArgMeta{ - {Type: "u64", Name: "boot_time"}, - {Type: "u64", Name: "start_time"}, - {Type: "const char*", Name: "version"}, + {Type: "unsigned long", Name: "boot_time"}, + {Type: "unsigned long", Name: "start_time"}, + {Type: "char*", Name: "version"}, }, }, SocketDup: { @@ -11912,11 +11912,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "size_t", Name: "count"}, - {Type: "off_t", Name: "pos"}, + {Type: "unsigned long", Name: "count"}, + {Type: "long", Name: "pos"}, }, }, DirtyPipeSplice: { @@ -11936,10 +11936,10 @@ var CoreEvents = map[ID]Definition{ }, params: []trace.ArgMeta{ {Type: "unsigned long", Name: "inode_in"}, - {Type: "umode_t", Name: "in_file_type"}, - {Type: "const char*", Name: "in_file_path"}, - {Type: "loff_t", Name: "exposed_data_start_offset"}, - {Type: "size_t", Name: "exposed_data_len"}, + {Type: "u16", Name: "in_file_type"}, + {Type: "char*", Name: "in_file_path"}, + {Type: "unsigned long", Name: "exposed_data_start_offset"}, + {Type: "unsigned long", Name: "exposed_data_len"}, {Type: "unsigned long", Name: "inode_out"}, {Type: "unsigned int", Name: "out_pipe_last_buffer_flags"}, }, @@ -11954,15 +11954,15 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "containers"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "runtime"}, - {Type: "const char*", Name: "container_id"}, + {Type: "char*", Name: "runtime"}, + {Type: "char*", Name: "container_id"}, {Type: "unsigned long", Name: "ctime"}, - {Type: "const char*", Name: "container_image"}, - {Type: "const char*", Name: "container_image_digest"}, - {Type: "const char*", Name: "container_name"}, - {Type: "const char*", Name: "pod_name"}, - {Type: "const char*", Name: "pod_namespace"}, - {Type: "const char*", Name: "pod_uid"}, + {Type: "char*", Name: "container_image"}, + {Type: "char*", Name: "container_image_digest"}, + {Type: "char*", Name: "container_name"}, + {Type: "char*", Name: "pod_name"}, + {Type: "char*", Name: "pod_namespace"}, + {Type: "char*", Name: "pod_uid"}, {Type: "bool", Name: "pod_sandbox"}, }, }, @@ -11976,8 +11976,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "containers"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "runtime"}, - {Type: "const char*", Name: "container_id"}, + {Type: "char*", Name: "runtime"}, + {Type: "char*", Name: "container_id"}, }, }, ExistingContainer: { @@ -11987,15 +11987,15 @@ var CoreEvents = map[ID]Definition{ version: NewVersion(1, 0, 0), sets: []string{"containers"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "runtime"}, - {Type: "const char*", Name: "container_id"}, + {Type: "char*", Name: "runtime"}, + {Type: "char*", Name: "container_id"}, {Type: "unsigned long", Name: "ctime"}, - {Type: "const char*", Name: "container_image"}, - {Type: "const char*", Name: "container_image_digest"}, - {Type: "const char*", Name: "container_name"}, - {Type: "const char*", Name: "pod_name"}, - {Type: "const char*", Name: "pod_namespace"}, - {Type: "const char*", Name: "pod_uid"}, + {Type: "char*", Name: "container_image"}, + {Type: "char*", Name: "container_image_digest"}, + {Type: "char*", Name: "container_name"}, + {Type: "char*", Name: "pod_name"}, + {Type: "char*", Name: "pod_namespace"}, + {Type: "char*", Name: "pod_uid"}, {Type: "bool", Name: "pod_sandbox"}, }, }, @@ -12045,7 +12045,7 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "const char*const*", Name: "argv"}, {Type: "const char*const*", Name: "envp"}, {Type: "int", Name: "wait"}, @@ -12063,9 +12063,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "file_name"}, - {Type: "const char*", Name: "path"}, - {Type: "mode_t", Name: "mode"}, + {Type: "char*", Name: "file_name"}, + {Type: "char*", Name: "path"}, + {Type: "unsigned int", Name: "mode"}, {Type: "void*", Name: "proc_ops_addr"}, }, }, @@ -12101,9 +12101,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "address"}, - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "srcversion"}, + {Type: "char*", Name: "address"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "srcversion"}, }, }, HiddenKernelModuleSeeker: { @@ -12159,10 +12159,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "syscall"}, - {Type: "const char*", Name: "address"}, - {Type: "const char*", Name: "function"}, - {Type: "const char*", Name: "owner"}, + {Type: "char*", Name: "syscall"}, + {Type: "char*", Name: "address"}, + {Type: "char*", Name: "function"}, + {Type: "char*", Name: "owner"}, }, }, DebugfsCreateDir: { @@ -12177,8 +12177,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "path"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "path"}, }, }, DeviceAdd: { @@ -12193,8 +12193,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "parent_name"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "parent_name"}, }, }, RegisterChrdev: { @@ -12212,8 +12212,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "unsigned int", Name: "requested_major_number"}, {Type: "unsigned int", Name: "granted_major_number"}, - {Type: "const char*", Name: "char_device_name"}, - {Type: "struct file_operations *", Name: "char_device_fops"}, + {Type: "char*", Name: "char_device_name"}, + {Type: "void*", Name: "char_device_fops"}, }, }, SharedObjectLoaded: { @@ -12233,9 +12233,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "int", Name: "flags"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, }, @@ -12254,7 +12254,7 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"derived", "fs", "security_alert"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "library_path"}, + {Type: "char*", Name: "library_path"}, {Type: "const char*const*", Name: "symbols"}, {Type: "const char *", Name: "sha256"}, }, @@ -12273,8 +12273,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "loaded_path"}, - {Type: "const char*", Name: "collision_path"}, + {Type: "char*", Name: "loaded_path"}, + {Type: "char*", Name: "collision_path"}, {Type: "const char*const*", Name: "symbols"}, }, }, @@ -12413,9 +12413,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "version"}, - {Type: "const char*", Name: "src_version"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "version"}, + {Type: "char*", Name: "src_version"}, }, }, ModuleLoad: { @@ -12430,13 +12430,13 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "version"}, - {Type: "const char*", Name: "src_version"}, - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "version"}, + {Type: "char*", Name: "src_version"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "u64", Name: "ctime"}, + {Type: "unsigned long", Name: "ctime"}, }, }, ModuleFree: { @@ -12451,9 +12451,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "name"}, - {Type: "const char*", Name: "version"}, - {Type: "const char*", Name: "src_version"}, + {Type: "char*", Name: "name"}, + {Type: "char*", Name: "version"}, + {Type: "char*", Name: "src_version"}, }, }, SocketAccept: { @@ -12493,8 +12493,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"proc"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, }, }, @@ -12587,8 +12587,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"proc"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "old_name"}, - {Type: "const char*", Name: "new_name"}, + {Type: "char*", Name: "old_name"}, + {Type: "char*", Name: "new_name"}, }, }, SecurityInodeRename: { @@ -12603,8 +12603,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "old_path"}, - {Type: "const char*", Name: "new_path"}, + {Type: "char*", Name: "old_path"}, + {Type: "char*", Name: "new_path"}, }, }, DoSigaction: { @@ -12651,11 +12651,11 @@ var CoreEvents = map[ID]Definition{ sets: []string{}, params: []trace.ArgMeta{ {Type: "int", Name: "prog_type"}, - {Type: "const char*", Name: "prog_name"}, - {Type: "u32", Name: "prog_id"}, + {Type: "char*", Name: "prog_name"}, + {Type: "unsigned int", Name: "prog_id"}, {Type: "unsigned long[]", Name: "prog_helpers"}, - {Type: "const char*", Name: "symbol_name"}, - {Type: "u64", Name: "symbol_addr"}, + {Type: "char*", Name: "symbol_name"}, + {Type: "unsigned long", Name: "symbol_addr"}, {Type: "int", Name: "attach_type"}, }, }, @@ -12673,7 +12673,7 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "symbol_name"}, + {Type: "char*", Name: "symbol_name"}, {Type: "void*", Name: "symbol_address"}, }, }, @@ -12706,8 +12706,8 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "bytes", Name: "bytes"}, {Type: "void*", Name: "address"}, - {Type: "u64", Name: "length"}, - {Type: "u64", Name: "caller_context_id"}, + {Type: "unsigned long", Name: "length"}, + {Type: "unsigned long", Name: "caller_context_id"}, {Type: "char*", Name: "arch"}, {Type: "char*", Name: "symbol_name"}, {Type: "char*", Name: "symbol_owner"}, @@ -12726,11 +12726,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "size_t", Name: "count"}, - {Type: "off_t", Name: "pos"}, + {Type: "unsigned long", Name: "count"}, + {Type: "long", Name: "pos"}, }, }, VfsReadv: { @@ -12746,11 +12746,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "vlen"}, - {Type: "off_t", Name: "pos"}, + {Type: "long", Name: "pos"}, }, }, VfsUtimes: { @@ -12766,11 +12766,11 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, - {Type: "u64", Name: "atime"}, - {Type: "u64", Name: "mtime"}, + {Type: "unsigned long", Name: "atime"}, + {Type: "unsigned long", Name: "mtime"}, }, }, DoTruncate: { @@ -12785,10 +12785,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned long", Name: "inode"}, - {Type: "dev_t", Name: "dev"}, - {Type: "u64", Name: "length"}, + {Type: "unsigned int", Name: "dev"}, + {Type: "unsigned long", Name: "length"}, }, }, FileModification: { @@ -12799,8 +12799,8 @@ var CoreEvents = map[ID]Definition{ docPath: "kprobes/file_modification.md", sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "file_path"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "file_path"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "old_ctime"}, {Type: "unsigned long", Name: "new_ctime"}, @@ -12829,9 +12829,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned long", Name: "inode"}, - {Type: "dev_t", Name: "dev"}, + {Type: "unsigned int", Name: "dev"}, }, }, SecurityBpfProg: { @@ -12851,9 +12851,9 @@ var CoreEvents = map[ID]Definition{ sets: []string{}, params: []trace.ArgMeta{ {Type: "int", Name: "type"}, - {Type: "const char*", Name: "name"}, + {Type: "char*", Name: "name"}, {Type: "unsigned long[]", Name: "helpers"}, - {Type: "u32", Name: "id"}, + {Type: "unsigned int", Name: "id"}, {Type: "bool", Name: "load"}, }, }, @@ -12880,14 +12880,14 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, {Type: "int", Name: "flags"}, - {Type: "const char*", Name: "pathname"}, - {Type: "const char*", Name: "binary.path"}, - {Type: "dev_t", Name: "binary.device_id"}, + {Type: "char*", Name: "pathname"}, + {Type: "char*", Name: "binary.path"}, + {Type: "unsigned int", Name: "binary.device_id"}, {Type: "unsigned long", Name: "binary.inode_number"}, {Type: "unsigned long", Name: "binary.ctime"}, - {Type: "umode_t", Name: "binary.inode_mode"}, - {Type: "const char*", Name: "interpreter_path"}, - {Type: "umode_t", Name: "stdin_type"}, + {Type: "u16", Name: "binary.inode_mode"}, + {Type: "char*", Name: "interpreter_path"}, + {Type: "u16", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "kernel_invoked"}, {Type: "const char*const*", Name: "argv"}, @@ -12914,14 +12914,14 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, {Type: "int", Name: "flags"}, - {Type: "const char*", Name: "pathname"}, - {Type: "const char*", Name: "binary.path"}, - {Type: "dev_t", Name: "binary.device_id"}, + {Type: "char*", Name: "pathname"}, + {Type: "char*", Name: "binary.path"}, + {Type: "unsigned int", Name: "binary.device_id"}, {Type: "unsigned long", Name: "binary.inode_number"}, {Type: "unsigned long", Name: "binary.ctime"}, - {Type: "umode_t", Name: "binary.inode_mode"}, - {Type: "const char*", Name: "interpreter_path"}, - {Type: "umode_t", Name: "stdin_type"}, + {Type: "u16", Name: "binary.inode_mode"}, + {Type: "char*", Name: "interpreter_path"}, + {Type: "u16", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "kernel_invoked"}, {Type: "const char*const*", Name: "argv"}, @@ -12940,14 +12940,14 @@ var CoreEvents = map[ID]Definition{ params: []trace.ArgMeta{ {Type: "int", Name: "dirfd"}, {Type: "int", Name: "flags"}, - {Type: "const char*", Name: "pathname"}, - {Type: "const char*", Name: "binary.path"}, - {Type: "dev_t", Name: "binary.device_id"}, + {Type: "char*", Name: "pathname"}, + {Type: "char*", Name: "binary.path"}, + {Type: "unsigned int", Name: "binary.device_id"}, {Type: "unsigned long", Name: "binary.inode_number"}, {Type: "unsigned long", Name: "binary.ctime"}, - {Type: "umode_t", Name: "binary.inode_mode"}, - {Type: "const char*", Name: "interpreter_path"}, - {Type: "umode_t", Name: "stdin_type"}, + {Type: "u16", Name: "binary.inode_mode"}, + {Type: "char*", Name: "interpreter_path"}, + {Type: "u16", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "kernel_invoked"}, {Type: "const char*const*", Name: "argv"}, @@ -12965,12 +12965,12 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "symbol"}, - {Type: "const char*", Name: "trampoline"}, - {Type: "const char*", Name: "callback"}, - {Type: "off_t", Name: "callback_offset"}, - {Type: "const char*", Name: "callback_owner"}, - {Type: "const char*", Name: "flags"}, + {Type: "char*", Name: "symbol"}, + {Type: "char*", Name: "trampoline"}, + {Type: "char*", Name: "callback"}, + {Type: "long", Name: "callback_offset"}, + {Type: "char*", Name: "callback_owner"}, + {Type: "char*", Name: "flags"}, {Type: "unsigned long", Name: "count"}, }, }, @@ -12986,10 +12986,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm_hooks", "fs_monitor"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "pathname"}, + {Type: "char*", Name: "pathname"}, {Type: "unsigned long", Name: "inode"}, - {Type: "dev_t", Name: "dev"}, - {Type: "u64", Name: "mask"}, + {Type: "unsigned int", Name: "dev"}, + {Type: "unsigned long", Name: "mask"}, {Type: "unsigned int", Name: "obj_type"}, }, }, @@ -13004,8 +13004,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "unresolved_path"}, - {Type: "const char*", Name: "resolved_path"}, + {Type: "char*", Name: "unresolved_path"}, + {Type: "char*", Name: "resolved_path"}, }, }, SecurityTaskSetrlimit: { @@ -13019,10 +13019,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm"}, params: []trace.ArgMeta{ - {Type: "u32", Name: "target_host_pid"}, + {Type: "unsigned int", Name: "target_host_pid"}, {Type: "int", Name: "resource"}, - {Type: "u64", Name: "new_rlim_cur"}, - {Type: "u64", Name: "new_rlim_max"}, + {Type: "unsigned long", Name: "new_rlim_cur"}, + {Type: "unsigned long", Name: "new_rlim_max"}, }, }, SecuritySettime64: { @@ -13036,8 +13036,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"lsm"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "tv_sec"}, - {Type: "u64", Name: "tv_nsec"}, + {Type: "unsigned long", Name: "tv_sec"}, + {Type: "unsigned long", Name: "tv_nsec"}, {Type: "int", Name: "tz_minuteswest"}, {Type: "int", Name: "tz_dsttime"}, }, @@ -13057,9 +13057,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"signal"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "cgroup_id"}, - {Type: "const char*", Name: "cgroup_path"}, - {Type: "u32", Name: "hierarchy_id"}, + {Type: "unsigned long", Name: "cgroup_id"}, + {Type: "char*", Name: "cgroup_path"}, + {Type: "unsigned int", Name: "hierarchy_id"}, }, }, SignalCgroupRmdir: { @@ -13074,9 +13074,9 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"signal"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "cgroup_id"}, - {Type: "const char*", Name: "cgroup_path"}, - {Type: "u32", Name: "hierarchy_id"}, + {Type: "unsigned long", Name: "cgroup_id"}, + {Type: "char*", Name: "cgroup_path"}, + {Type: "unsigned int", Name: "hierarchy_id"}, }, }, SignalSchedProcessFork: { @@ -13091,7 +13091,7 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"signal"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "timestamp"}, + {Type: "unsigned long", Name: "timestamp"}, // Real Parent {Type: "int", Name: "parent_tid"}, {Type: "int", Name: "parent_ns_tid"}, @@ -13133,26 +13133,26 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"signal"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "timestamp"}, - {Type: "u32", Name: "task_hash"}, - {Type: "u32", Name: "parent_hash"}, - {Type: "u32", Name: "leader_hash"}, + {Type: "unsigned long", Name: "timestamp"}, + {Type: "unsigned int", Name: "task_hash"}, + {Type: "unsigned int", Name: "parent_hash"}, + {Type: "unsigned int", Name: "leader_hash"}, // command - {Type: "const char*", Name: "cmdpath"}, - {Type: "const char*", Name: "pathname"}, - {Type: "dev_t", Name: "dev"}, + {Type: "char*", Name: "cmdpath"}, + {Type: "char*", Name: "pathname"}, + {Type: "unsigned int", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "unsigned long", Name: "ctime"}, - {Type: "umode_t", Name: "inode_mode"}, + {Type: "u16", Name: "inode_mode"}, // interpreter - {Type: "const char*", Name: "interpreter_pathname"}, - {Type: "dev_t", Name: "interpreter_dev"}, + {Type: "char*", Name: "interpreter_pathname"}, + {Type: "unsigned int", Name: "interpreter_dev"}, {Type: "unsigned long", Name: "interpreter_inode"}, {Type: "unsigned long", Name: "interpreter_ctime"}, // other {Type: "const char**", Name: "argv"}, - {Type: "const char*", Name: "interp"}, - {Type: "umode_t", Name: "stdin_type"}, + {Type: "char*", Name: "interp"}, + {Type: "u16", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "invoked_from_kernel"}, }, @@ -13169,10 +13169,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"signal"}, params: []trace.ArgMeta{ - {Type: "u64", Name: "timestamp"}, - {Type: "u32", Name: "task_hash"}, - {Type: "u32", Name: "parent_hash"}, - {Type: "u32", Name: "leader_hash"}, + {Type: "unsigned long", Name: "timestamp"}, + {Type: "unsigned int", Name: "task_hash"}, + {Type: "unsigned int", Name: "parent_hash"}, + {Type: "unsigned int", Name: "leader_hash"}, {Type: "long", Name: "exit_code"}, {Type: "bool", Name: "process_group_exit"}, }, @@ -13249,8 +13249,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoIPv4", Name: "proto_ipv4"}, }, @@ -13267,8 +13267,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoIPv6", Name: "proto_ipv6"}, }, @@ -13301,10 +13301,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoTCP", Name: "proto_tcp"}, }, @@ -13337,10 +13337,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoUDP", Name: "proto_udp"}, }, @@ -13373,8 +13373,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoICMP", Name: "proto_icmp"}, }, @@ -13407,8 +13407,8 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"default", "network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoICMPv6", Name: "proto_icmpv6"}, }, @@ -13441,10 +13441,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoDNS", Name: "proto_dns"}, }, @@ -13509,10 +13509,10 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "const char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering - {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "src"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "char*", Name: "dst"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "src_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering + {Type: "u16", Name: "dst_port"}, // TODO: pack and remove into trace.PacketMetadata after it supports filtering {Type: "trace.PacketMetadata", Name: "metadata"}, {Type: "trace.ProtoHTTP", Name: "proto_http"}, }, @@ -13604,13 +13604,13 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events", "flows"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "conn_direction"}, - {Type: "const char*", Name: "src"}, - {Type: "const char*", Name: "dst"}, + {Type: "char*", Name: "conn_direction"}, + {Type: "char*", Name: "src"}, + {Type: "char*", Name: "dst"}, {Type: "u16", Name: "src_port"}, {Type: "u16", Name: "dst_port"}, - {Type: "const char **", Name: "src_dns"}, - {Type: "const char **", Name: "dst_dns"}, + {Type: "const char**", Name: "src_dns"}, + {Type: "const char**", Name: "dst_dns"}, }, }, NetFlowTCPEnd: { @@ -13625,13 +13625,13 @@ var CoreEvents = map[ID]Definition{ }, sets: []string{"network_events", "flows"}, params: []trace.ArgMeta{ - {Type: "const char*", Name: "conn_direction"}, - {Type: "const char*", Name: "src"}, - {Type: "const char*", Name: "dst"}, + {Type: "char*", Name: "conn_direction"}, + {Type: "char*", Name: "src"}, + {Type: "char*", Name: "dst"}, {Type: "u16", Name: "src_port"}, {Type: "u16", Name: "dst_port"}, - {Type: "const char **", Name: "src_dns"}, - {Type: "const char **", Name: "dst_dns"}, + {Type: "const char**", Name: "src_dns"}, + {Type: "const char**", Name: "dst_dns"}, }, }, diff --git a/pkg/events/derive/symbols_loaded_test.go b/pkg/events/derive/symbols_loaded_test.go index 33052b01f8f5..1eb183690603 100644 --- a/pkg/events/derive/symbols_loaded_test.go +++ b/pkg/events/derive/symbols_loaded_test.go @@ -62,7 +62,7 @@ func generateSOLoadedEvent(pid int, so sharedobjs.ObjInfo) trace.Event { Args: []trace.Argument{ {ArgMeta: trace.ArgMeta{Type: "const char*", Name: "pathname"}, Value: so.Path}, {ArgMeta: trace.ArgMeta{Type: "int", Name: "flags"}, Value: 0}, - {ArgMeta: trace.ArgMeta{Type: "dev_t", Name: "dev"}, Value: so.Id.Device}, + {ArgMeta: trace.ArgMeta{Type: "unsigned int", Name: "dev"}, Value: so.Id.Device}, {ArgMeta: trace.ArgMeta{Type: "unsigned long", Name: "inode"}, Value: so.Id.Inode}, {ArgMeta: trace.ArgMeta{Type: "unsigned long", Name: "ctime"}, Value: so.Id.Ctime}, }, diff --git a/pkg/events/parse/params.go b/pkg/events/parse/params.go index 84d1186a82af..aac92022329f 100644 --- a/pkg/events/parse/params.go +++ b/pkg/events/parse/params.go @@ -1,8 +1,6 @@ package parse import ( - "strings" - "github.com/aquasecurity/tracee/pkg/errfmt" "github.com/aquasecurity/tracee/types/trace" ) @@ -39,55 +37,24 @@ func ArgZeroValueFromType(t string) interface{} { case "s16", "short": return int16(0) - case "u16", - "unsigned short", - "old_gid_t", - "old_uid_t", - "umode_t": + case "u16": return uint16(0) - case "s32", - "int", - "pid_t", - "key_t", - "clockid_t", - "const clockid_t", - "timer_t", - "mqd_t", - "key_serial_t": + case "int": return int32(0) - case "u32", - "unsigned int", - "dev_t", - "uid_t", - "gid_t", - "size_t", - "mode_t", - "qid_t", - "landlock_rule_type": + case "unsigned int": return uint32(0) case "int[2]": return [2]int32{} - case "s64", - "long", - "long long", - "off_t", - "loff_t": + case "long": return int64(0) - case "u64", - "unsigned long", - "unsigned long long", - "const unsigned long", - "const unsigned long long", - "aio_context_t": + case "unsigned long": return uint64(0) case "unsigned long[]": return []uint64{} - case "char*", - "const char*", - "const char *": + case "char*": return string("") case "const char**", - "const char **": + "const char*const*": return []string{} case "bool": return false @@ -129,27 +96,12 @@ func ArgZeroValueFromType(t string) interface{} { return []trace.HookedSymbolData{} case "map[string]trace.HookedSymbolData": return map[string]trace.HookedSymbolData{} - default: - // + case "void*": // pointer types - // - switch { - case strings.HasSuffix(t, "*"), - strings.HasSuffix(t, " *restrict"): - return uintptr(0) - } - switch t { - case "cap_user_header_t", - "cap_user_data_t", - "const cap_user_data_t", - "io_context_t", - "sighandler_t": - return uintptr(0) - } - - // unknown type - return nil + return uintptr(0) } + // unknown type + return nil } // ArgIndex find the index of an argument by name diff --git a/pkg/policy/ebpf.go b/pkg/policy/ebpf.go index a732cb6099d2..3c9906830bf3 100644 --- a/pkg/policy/ebpf.go +++ b/pkg/policy/ebpf.go @@ -10,13 +10,13 @@ import ( bpf "github.com/aquasecurity/libbpfgo" - "github.com/aquasecurity/tracee/pkg/bufferdecoder" "github.com/aquasecurity/tracee/pkg/containers" "github.com/aquasecurity/tracee/pkg/errfmt" "github.com/aquasecurity/tracee/pkg/events" "github.com/aquasecurity/tracee/pkg/filters" "github.com/aquasecurity/tracee/pkg/logger" "github.com/aquasecurity/tracee/pkg/utils/proc" + "github.com/aquasecurity/tracee/types/trace" ) const ( @@ -159,7 +159,7 @@ func (ps *policies) createNewFilterMapsVersion(bpfModule *bpf.Module) error { func (ps *policies) createNewEventsMapVersion( bpfModule *bpf.Module, rules map[events.ID]*eventFlags, - eventsParams map[events.ID][]bufferdecoder.ArgType, + eventArgumentTypes map[events.ID][]trace.DecodeAs, ) error { polsVersion := ps.version() innerMapName := "events_map" @@ -185,13 +185,23 @@ func (ps *policies) createNewEventsMapVersion( // bitmap of policies that require this event to be submitted binary.LittleEndian.PutUint64(eventConfigVal[0:8], ecfg.policiesSubmit) - // encoded event's parameter types - var paramTypes uint64 - params := eventsParams[id] - for n, paramType := range params { - paramTypes = paramTypes | (uint64(paramType) << (8 * n)) + // encoded event's argument types + var encodedArgTypes uint64 + // current event arg types + argTypes := eventArgumentTypes[id] + + /* + each event may have at most 8 argument data types stored. + in the map, the arguments are stored in a 64bit sized bitmap where each 8 bits + represent some argument type. + For example consider an event with two int arguments (argType = 1) and one string + (argType = 10): + 0 0 0 0 0 a 1 1 - would be the encoded argument types bitmap + */ + for n, paramType := range argTypes { + encodedArgTypes = encodedArgTypes | (uint64(paramType) << (8 * n)) } - binary.LittleEndian.PutUint64(eventConfigVal[8:16], paramTypes) + binary.LittleEndian.PutUint64(eventConfigVal[8:16], encodedArgTypes) err := newInnerMap.Update(unsafe.Pointer(&id), unsafe.Pointer(&eventConfigVal[0])) if err != nil { @@ -451,13 +461,13 @@ func (ps *policies) updateBPF( bpfModule *bpf.Module, cts *containers.Containers, rules map[events.ID]*eventFlags, - eventsParams map[events.ID][]bufferdecoder.ArgType, + eventArgumentTypes map[events.ID][]trace.DecodeAs, createNewMaps bool, updateProcTree bool, ) (*PoliciesConfig, error) { if createNewMaps { // Create new events map version - if err := ps.createNewEventsMapVersion(bpfModule, rules, eventsParams); err != nil { + if err := ps.createNewEventsMapVersion(bpfModule, rules, eventArgumentTypes); err != nil { return nil, errfmt.WrapError(err) } } diff --git a/pkg/policy/policy_manager.go b/pkg/policy/policy_manager.go index 40109f178469..683054018c88 100644 --- a/pkg/policy/policy_manager.go +++ b/pkg/policy/policy_manager.go @@ -5,7 +5,6 @@ import ( bpf "github.com/aquasecurity/libbpfgo" - "github.com/aquasecurity/tracee/pkg/bufferdecoder" "github.com/aquasecurity/tracee/pkg/capabilities" "github.com/aquasecurity/tracee/pkg/config" "github.com/aquasecurity/tracee/pkg/containers" @@ -17,6 +16,7 @@ import ( "github.com/aquasecurity/tracee/pkg/pcaps" "github.com/aquasecurity/tracee/pkg/proctree" "github.com/aquasecurity/tracee/pkg/utils" + "github.com/aquasecurity/tracee/types/trace" ) type ManagerConfig struct { @@ -593,12 +593,12 @@ func (m *Manager) LookupByName(name string) (*Policy, error) { func (m *Manager) UpdateBPF( bpfModule *bpf.Module, cts *containers.Containers, - eventsParams map[events.ID][]bufferdecoder.ArgType, + eventArgumentTypes map[events.ID][]trace.DecodeAs, createNewMaps bool, updateProcTree bool, ) (*PoliciesConfig, error) { m.mu.Lock() defer m.mu.Unlock() - return m.ps.updateBPF(bpfModule, cts, m.rules, eventsParams, createNewMaps, updateProcTree) + return m.ps.updateBPF(bpfModule, cts, m.rules, eventArgumentTypes, createNewMaps, updateProcTree) } diff --git a/pkg/server/grpc/event_data_test.go b/pkg/server/grpc/event_data_test.go index 44e53fba598c..2c7e0e66ddc5 100644 --- a/pkg/server/grpc/event_data_test.go +++ b/pkg/server/grpc/event_data_test.go @@ -128,7 +128,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "pos", - Type: "off_t", + Type: "long", }, Value: uint64(2), }, @@ -168,7 +168,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "dev", - Type: "dev_t", + Type: "unsigned int", }, Value: uint32(59), }, @@ -298,7 +298,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "inode_mode", - Type: "umode_t", + Type: "u16", }, Value: uint16(1818), }, @@ -532,7 +532,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "inode_mode", - Type: "umode_t", + Type: "u16", }, Value: uint16(1818), }, @@ -580,7 +580,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "inode_mode", - Type: "umode_t", + Type: "u16", }, Value: uint16(1818), }, @@ -608,7 +608,7 @@ func Test_getEventData(t *testing.T) { { ArgMeta: trace.ArgMeta{ Name: "inode_mode", - Type: "umode_t", + Type: "u16", }, Value: uint16(1818), }, diff --git a/types/trace/trace.go b/types/trace/trace.go index 3e55f6a2f9e0..708df9e9d6e0 100644 --- a/types/trace/trace.go +++ b/types/trace/trace.go @@ -134,11 +134,57 @@ type Argument struct { Value interface{} `json:"value"` } +// DecodeAs is an enum that encodes the argument types that an +// eBPF program may write to the shared buffer. In practice they designate +// either/or a type which is specifically encoded as an argument type in eBPF +// or a strategy of passing an argument on the submission buffer via some +// function. +type DecodeAs uint16 + +// The types of this section in particular are those possibly submitted in +// syscall events. Therefore, these should match to the type enum and table in: +// pkg/ebpf/c/types.h and buffer.h respetively. +const ( + NONE_T DecodeAs = iota // Default value - the argument does not originate from a decodable buffer. + INT_T + UINT_T + LONG_T + ULONG_T + U16_T + U8_T + INT_ARR_2_T + UINT64_ARR_T + POINTER_T + BYTES_T + STR_T + STR_ARR_T + SOCK_ADDR_T + CRED_T + TIMESPEC_T +) + +// These types are in a seprate section since they are not defined as enums in the ebpf code. +// That is because they are unused by syscalls. +// Instead, they designate a functional submission strategy. +// (ie. ARGS_ARR_T is submitted by the strategy defined in buffer.h:save_args_str_arr_to_buf). +const ( + ARGS_ARR_T DecodeAs = iota + 128 + BOOL_T + FLOAT_T + FLOAT64_T + MAX_TRACEE_DECODES +) +const ( + USER_DEFINED_DEOCDE_BEGIN DecodeAs = iota + 256 +) + // ArgMeta describes an argument type ArgMeta struct { Name string `json:"name"` Type string `json:"type"` + // DecodeAs includes designates the decoding strategy. + DecodeAs DecodeAs `json: "-` // Zero contains the zero value for Argument.Value. // It is automatically initialized based on ArgMeta.Type when the Core DefinitionGroup is initialized. Zero interface{} `json:"-"` @@ -166,7 +212,7 @@ func (arg *Argument) UnmarshalJSON(b []byte) error { return nil } switch arg.Type { - case "int", "pid_t", "uid_t", "gid_t", "mqd_t", "clockid_t", "const clockid_t", "key_t", "key_serial_t", "timer_t", "landlock_rule_type": + case "int": tmp, err := strconv.ParseInt(num.String(), 10, 32) if err != nil { return err @@ -178,13 +224,13 @@ func (arg *Argument) UnmarshalJSON(b []byte) error { return err } arg.Value = tmp - case "unsigned int", "u32", "mode_t", "dev_t": + case "unsigned int": tmp, err := strconv.ParseUint(num.String(), 10, 32) if err != nil { return err } arg.Value = uint32(tmp) - case "unsigned long", "u64", "off_t", "size_t": + case "unsigned long": tmp, err := strconv.ParseUint(num.String(), 10, 64) if err != nil { return err @@ -196,13 +242,13 @@ func (arg *Argument) UnmarshalJSON(b []byte) error { return err } arg.Value = float32(tmp) - case "float64", "double": + case "float64": tmp, err := num.Float64() if err != nil { return err } arg.Value = tmp - case "unsigned short", "old_uid_t", "old_gid_t", "umode_t", "u16", "uint16": + case "u16": tmp, err := strconv.ParseUint(num.String(), 10, 16) if err != nil { return err @@ -214,7 +260,7 @@ func (arg *Argument) UnmarshalJSON(b []byte) error { return err } arg.Value = int8(tmp) - case "u8", "uint8": + case "u8": tmp, err := strconv.ParseUint(num.String(), 10, 8) if err != nil { return err @@ -447,9 +493,6 @@ func (arg *Argument) UnmarshalJSON(b []byte) error { if !ok { return fmt.Errorf("packet metadata: type error") } - if err != nil { - return err - } argPacketMetadata, err = jsonConvertToPacketMetadata(argPacketMetadataMap) if err != nil { return err @@ -935,9 +978,6 @@ func jsonConvertToProtoDNSResourceRecordType(argMap map[string]interface{}) (Pro } txtsValue = jsonConvertToStringSlice(txtsInterfaceSlice) - if err != nil { - return ProtoDNSResourceRecord{}, err - } } // SOA conversion diff --git a/types/trace/trace_test.go b/types/trace/trace_test.go index 5abf8943436a..5fcacc43dacf 100644 --- a/types/trace/trace_test.go +++ b/types/trace/trace_test.go @@ -30,7 +30,7 @@ func TestEventUnmarshalJSON(t *testing.T) { "pidnamespace":4026531836,"processname":"strace","hostname":"ubuntu","eventid":"101","eventname":"ptrace", "argsnum":4,"returnvalue":0,"args":[{"name":"request","type":"long","value":"ptrace_seize"}, {"name":"pid","type":"pid_t","value":12435},{"name":"addr","type":"void*","value":"0x0"},{"name":"data","type":"void*","value":"0x7f6f1eb44b83"}]}`, - expect: Event{Timestamp: 26018249532, ProcessID: 12434, ThreadID: 12434, ParentProcessID: 23921, HostProcessID: 12434, HostThreadID: 12434, HostParentProcessID: 23921, UserID: 1000, MountNS: 4026531840, PIDNS: 4026531836, ProcessName: "strace", HostName: "ubuntu", EventID: 101, EventName: "ptrace", ArgsNum: 4, ReturnValue: 0, Args: []Argument{{ArgMeta: ArgMeta{Name: "request", Type: "long"}, Value: "ptrace_seize"}, {ArgMeta: ArgMeta{Name: "pid", Type: "pid_t"}, Value: int32(12435)}, {ArgMeta: ArgMeta{Name: "addr", Type: "void*"}, Value: "0x0"}, {ArgMeta: ArgMeta{Name: "data", Type: "void*"}, Value: "0x7f6f1eb44b83"}}, ContextFlags: ContextFlags{ContainerStarted: false}}, + expect: Event{Timestamp: 26018249532, ProcessID: 12434, ThreadID: 12434, ParentProcessID: 23921, HostProcessID: 12434, HostThreadID: 12434, HostParentProcessID: 23921, UserID: 1000, MountNS: 4026531840, PIDNS: 4026531836, ProcessName: "strace", HostName: "ubuntu", EventID: 101, EventName: "ptrace", ArgsNum: 4, ReturnValue: 0, Args: []Argument{{ArgMeta: ArgMeta{Name: "request", Type: "long"}, Value: "ptrace_seize"}, {ArgMeta: ArgMeta{Name: "pid", Type: "int"}, Value: int32(12435)}, {ArgMeta: ArgMeta{Name: "addr", Type: "void*"}, Value: "0x0"}, {ArgMeta: ArgMeta{Name: "data", Type: "void*"}, Value: "0x7f6f1eb44b83"}}, ContextFlags: ContextFlags{ContainerStarted: false}}, }, } for _, tc := range testCases { From ebe9be27b3b866015d193175e58039405c83ec3d Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Thu, 10 Oct 2024 08:45:56 +0000 Subject: [PATCH 2/5] chore(bufferdecoder): readability refactors Move some functions around, rename and improve documentation. --- pkg/bufferdecoder/decoder.go | 22 +++++++- pkg/bufferdecoder/eventsreader.go | 55 +++++++++----------- pkg/bufferdecoder/eventsreader_bench_test.go | 8 +-- pkg/bufferdecoder/eventsreader_test.go | 6 +-- pkg/ebpf/capture.go | 2 +- 5 files changed, 52 insertions(+), 41 deletions(-) diff --git a/pkg/bufferdecoder/decoder.go b/pkg/bufferdecoder/decoder.go index ef5f5f2d3c8b..9bfcf62092b5 100644 --- a/pkg/bufferdecoder/decoder.go +++ b/pkg/bufferdecoder/decoder.go @@ -39,8 +39,14 @@ func (decoder *EbpfDecoder) BuffLen() int { return len(decoder.buffer) } -// ReadAmountBytes returns the total amount of bytes that decoder has read from its buffer up until now. -func (decoder *EbpfDecoder) ReadAmountBytes() int { +// BytesRead returns the total amount of bytes that decoder has read from its buffer up until now. +func (decoder *EbpfDecoder) BytesRead() int { + return decoder.cursor +} + +// MoveCursor moves the buffer cursor over n bytes. Returns the new cursor position. +func (decoder *EbpfDecoder) MoveCursor(n int) int { + decoder.cursor += n return decoder.cursor } @@ -260,6 +266,18 @@ func (decoder *EbpfDecoder) DecodeBytes(msg []byte, size int) error { return nil } +// ReadBytesLen is a helper which allocates a known size bytes buffer and decodes +// the bytes from the buffer into it. +func (decoder *EbpfDecoder) ReadBytesLen(len int) ([]byte, error) { + var err error + res := make([]byte, len) + err = decoder.DecodeBytes(res[:], len) + if err != nil { + return nil, errfmt.Errorf("error reading byte array: %v", err) + } + return res, nil +} + // DecodeIntArray translate from the decoder buffer, starting from the decoder cursor, to msg, size * 4 bytes (in order to get int32). func (decoder *EbpfDecoder) DecodeIntArray(msg []int32, size int) error { offset := decoder.cursor diff --git a/pkg/bufferdecoder/eventsreader.go b/pkg/bufferdecoder/eventsreader.go index 4e666cc97bd8..ca8d42593656 100644 --- a/pkg/bufferdecoder/eventsreader.go +++ b/pkg/bufferdecoder/eventsreader.go @@ -76,23 +76,22 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A case trace.STR_T: res, err = readStringFromBuff(ebpfMsgDecoder) case trace.STR_ARR_T: - // TODO optimization: create slice after getting arrLen - var ss []string var arrLen uint8 err = ebpfMsgDecoder.DecodeUint8(&arrLen) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading string array number of elements: %v", err) } + strSlice := make([]string, 0, arrLen) for i := 0; i < int(arrLen); i++ { s, err := readStringFromBuff(ebpfMsgDecoder) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading string element: %v", err) } - ss = append(ss, s) + strSlice = append(strSlice, s) } - res = ss + res = strSlice case trace.ARGS_ARR_T: - var ss []string + var strSlice []string var arrLen uint32 var argNum uint32 @@ -104,18 +103,18 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading args number: %v", err) } - resBytes, err := ReadByteSliceFromBuff(ebpfMsgDecoder, int(arrLen)) + resBytes, err := ebpfMsgDecoder.ReadBytesLen(int(arrLen)) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading args array: %v", err) } - ss = strings.Split(string(resBytes), "\x00") - if ss[len(ss)-1] == "" { - ss = ss[:len(ss)-1] + strSlice = strings.Split(string(resBytes), "\x00") + if strSlice[len(strSlice)-1] == "" { + strSlice = strSlice[:len(strSlice)-1] } - for int(argNum) > len(ss) { - ss = append(ss, "?") + for int(argNum) > len(strSlice) { + strSlice = append(strSlice, "?") } - res = ss + res = strSlice case trace.BYTES_T: var size uint32 err = ebpfMsgDecoder.DecodeUint32(&size) @@ -126,7 +125,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A if size > 4096 && (id < events.NetPacketBase || id > events.MaxNetID) { return uint(argIdx), arg, errfmt.Errorf("byte array size too big: %d", size) } - res, err = ReadByteSliceFromBuff(ebpfMsgDecoder, int(size)) + res, err = ebpfMsgDecoder.ReadBytesLen(int(size)) case trace.INT_ARR_2_T: var intArray [2]int32 err = ebpfMsgDecoder.DecodeIntArray(intArray[:], 2) @@ -225,7 +224,7 @@ func readSockaddrFromBuff(ebpfMsgDecoder *EbpfDecoder) (map[string]string, error char sun_path[108]; // Pathname }; */ - sunPath, err := readStringVarFromBuff(ebpfMsgDecoder, 108) + sunPath, err := readVarStringFromBuffer(ebpfMsgDecoder, 108) if err != nil { return nil, errfmt.Errorf("error parsing sockaddr_un: %v", err) } @@ -255,7 +254,7 @@ func readSockaddrFromBuff(ebpfMsgDecoder *EbpfDecoder) (map[string]string, error return nil, errfmt.Errorf("error parsing sockaddr_in: %v", err) } res["sin_addr"] = PrintUint32IP(addr) - _, err := ReadByteSliceFromBuff(ebpfMsgDecoder, 8) + _, err := ebpfMsgDecoder.ReadBytesLen(8) if err != nil { return nil, errfmt.Errorf("error parsing sockaddr_in: %v", err) } @@ -286,7 +285,7 @@ func readSockaddrFromBuff(ebpfMsgDecoder *EbpfDecoder) (map[string]string, error return nil, errfmt.Errorf("error parsing sockaddr_in6: %v", err) } res["sin6_flowinfo"] = strconv.Itoa(int(flowinfo)) - addr, err := ReadByteSliceFromBuff(ebpfMsgDecoder, 16) + addr, err := ebpfMsgDecoder.ReadBytesLen(16) if err != nil { return nil, errfmt.Errorf("error parsing sockaddr_in6: %v", err) } @@ -301,6 +300,9 @@ func readSockaddrFromBuff(ebpfMsgDecoder *EbpfDecoder) (map[string]string, error return res, nil } +// readStringFromBuff reads strings from the event buffer using the following format: +// +// [32bit:string_size][string_size-1:byte_buffer][8bit:null_terminator] func readStringFromBuff(ebpfMsgDecoder *EbpfDecoder) (string, error) { var err error var size uint32 @@ -311,7 +313,7 @@ func readStringFromBuff(ebpfMsgDecoder *EbpfDecoder) (string, error) { if size > 4096 { return "", errfmt.Errorf("string size too big: %d", size) } - res, err := ReadByteSliceFromBuff(ebpfMsgDecoder, int(size-1)) // last byte is string terminating null + res, err := ebpfMsgDecoder.ReadBytesLen(int(size - 1)) // last byte is string terminating null defer func() { var dummy int8 err := ebpfMsgDecoder.DecodeInt8(&dummy) // discard last byte which is string terminating null @@ -325,9 +327,10 @@ func readStringFromBuff(ebpfMsgDecoder *EbpfDecoder) (string, error) { return string(res), nil } -// readStringVarFromBuff reads a null-terminated string from `buff` -// max length can be passed as `max` to optimize memory allocation, otherwise pass 0 -func readStringVarFromBuff(decoder *EbpfDecoder, max int) (string, error) { +// readVarStringFromBuffer reads a null-terminated string from the ebpf buffer where the size is not +// known. The helper will read from the buffer char-by-char until it hits the null terminator +// or the given max length. The cursor will then skip to the point in the buffer after the max length. +func readVarStringFromBuffer(decoder *EbpfDecoder, max int) (string, error) { var err error var char int8 res := make([]byte, 0, max) @@ -352,20 +355,10 @@ func readStringVarFromBuff(decoder *EbpfDecoder, max int) (string, error) { // The exact reason for this Trim is not known, so remove it for now, // since it increases processing time. // res = bytes.TrimLeft(res[:], "\000") - decoder.cursor += max - count // move cursor to the end of the buffer + decoder.MoveCursor(max - count) // skip the cursor to the desired endpoint return string(res), nil } -func ReadByteSliceFromBuff(ebpfMsgDecoder *EbpfDecoder, len int) ([]byte, error) { - var err error - res := make([]byte, len) - err = ebpfMsgDecoder.DecodeBytes(res[:], len) - if err != nil { - return nil, errfmt.Errorf("error reading byte array: %v", err) - } - return res, nil -} - // PrintUint32IP prints the IP address encoded as a uint32 func PrintUint32IP(in uint32) string { ip := make(net.IP, net.IPv4len) diff --git a/pkg/bufferdecoder/eventsreader_bench_test.go b/pkg/bufferdecoder/eventsreader_bench_test.go index 305b0c3f9d50..bd1136a69ceb 100644 --- a/pkg/bufferdecoder/eventsreader_bench_test.go +++ b/pkg/bufferdecoder/eventsreader_bench_test.go @@ -12,7 +12,7 @@ func BenchmarkReadStringVarFromBuff_ShortString(b *testing.B) { for i := 0; i < b.N; i++ { decoder := New(buffer) - str, _ = readStringVarFromBuff(decoder, max) + str, _ = readVarStringFromBuffer(decoder, max) } _ = str } @@ -24,7 +24,7 @@ func BenchmarkReadStringVarFromBuff_MediumString(b *testing.B) { for i := 0; i < b.N; i++ { decoder := New(buffer) - str, _ = readStringVarFromBuff(decoder, max) + str, _ = readVarStringFromBuffer(decoder, max) } _ = str } @@ -37,7 +37,7 @@ func BenchmarkReadStringVarFromBuff_LongString(b *testing.B) { b.ResetTimer() for i := 0; i < b.N; i++ { decoder := New(buffer) - str, _ = readStringVarFromBuff(decoder, max) + str, _ = readVarStringFromBuffer(decoder, max) } _ = str } @@ -50,7 +50,7 @@ func BenchmarkReadStringVarFromBuff_LongStringLowMax(b *testing.B) { b.ResetTimer() for i := 0; i < b.N; i++ { decoder := New(buffer) - str, _ = readStringVarFromBuff(decoder, max) + str, _ = readVarStringFromBuffer(decoder, max) } _ = str } diff --git a/pkg/bufferdecoder/eventsreader_test.go b/pkg/bufferdecoder/eventsreader_test.go index 5ffd7a207fbc..efbc6d28f3da 100644 --- a/pkg/bufferdecoder/eventsreader_test.go +++ b/pkg/bufferdecoder/eventsreader_test.go @@ -183,7 +183,7 @@ func TestReadArgFromBuff(t *testing.T) { if tc.name == "unknown" { return } - assert.Empty(t, decoder.BuffLen()-decoder.ReadAmountBytes(), tc.name) // passed in buffer should be emptied out + assert.Empty(t, decoder.BuffLen()-decoder.BytesRead(), tc.name) // passed in buffer should be emptied out }) } } @@ -258,13 +258,13 @@ func TestReadStringVarFromBuff(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { decoder := New(tt.buffer) - actual, err := readStringVarFromBuff(decoder, tt.max) + actual, err := readVarStringFromBuffer(decoder, tt.max) if tt.expectError { assert.Error(t, err) } else { assert.NoError(t, err) assert.Equal(t, tt.expected, actual) - assert.Equal(t, tt.expectedCursor, decoder.ReadAmountBytes()) + assert.Equal(t, tt.expectedCursor, decoder.BytesRead()) } }) } diff --git a/pkg/ebpf/capture.go b/pkg/ebpf/capture.go index 296c8f35bbc3..f17a81bcdc88 100644 --- a/pkg/ebpf/capture.go +++ b/pkg/ebpf/capture.go @@ -170,7 +170,7 @@ func (t *Tracee) handleFileCaptures(ctx context.Context) { } } - dataBytes, err := bufferdecoder.ReadByteSliceFromBuff(ebpfMsgDecoder, int(meta.Size)) + dataBytes, err := ebpfMsgDecoder.ReadBytesLen(int(meta.Size)) if err != nil { if err := f.Close(); err != nil { t.handleError(err) From 22d5ea7f36a74adcf554f3937b55c8e0dc7755e1 Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Thu, 10 Oct 2024 10:23:34 +0000 Subject: [PATCH 3/5] wip: standardize strarr buffer submit --- pkg/ebpf/c/common/buffer.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/ebpf/c/common/buffer.h b/pkg/ebpf/c/common/buffer.h index 742a277082e5..ea9fee7955d9 100644 --- a/pkg/ebpf/c/common/buffer.h +++ b/pkg/ebpf/c/common/buffer.h @@ -260,8 +260,9 @@ statfunc int save_str_arr_to_buf(args_buffer_t *buf, const char __user *const __ statfunc int save_args_str_arr_to_buf( args_buffer_t *buf, const char *start, const char *end, int elem_num, u8 index) { - // Data saved to submit buf: [index][len][arg_len][arg #][null delimited string array] - // Note: This helper saves null (0x00) delimited string array into buf + // Data saved to submit buf: [index][len][arg_len][arg #][array of null delimited string] + // Note: This helper saves null (0x00) delimited string array into buf in the format: + // [[str1][\n][str2][\n][...][strn][\n])] if (start >= end) return 0; From 114f9a844e167c518a82af045fc0b8028f20b8da Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Wed, 16 Oct 2024 11:41:03 +0000 Subject: [PATCH 4/5] decode strategies --- pkg/bufferdecoder/eventsreader.go | 6 ++++-- types/trace/trace.go | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/pkg/bufferdecoder/eventsreader.go b/pkg/bufferdecoder/eventsreader.go index ca8d42593656..7af153d3cbcb 100644 --- a/pkg/bufferdecoder/eventsreader.go +++ b/pkg/bufferdecoder/eventsreader.go @@ -13,6 +13,8 @@ import ( "github.com/aquasecurity/tracee/types/trace" ) +var decodeStrategies map[trace.DecodeAs]func() + // readArgFromBuff read the next argument from the buffer. // Return the index of the argument and the parsed argument. func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.ArgMeta, @@ -32,7 +34,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A return 0, arg, errfmt.Errorf("invalid arg index %d", argIdx) } arg.ArgMeta = params[argIdx] - argType := GetParamType(arg.Type) + argType := GetDecodeType(arg.Type) switch argType { case trace.U8_T: @@ -161,7 +163,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A return uint(argIdx), arg, nil } -func GetParamType(paramType string) trace.DecodeAs { +func GetDecodeType(paramType string) trace.DecodeAs { switch paramType { case "int": return trace.INT_T diff --git a/types/trace/trace.go b/types/trace/trace.go index 708df9e9d6e0..11b37c855e33 100644 --- a/types/trace/trace.go +++ b/types/trace/trace.go @@ -184,7 +184,7 @@ type ArgMeta struct { Type string `json:"type"` // DecodeAs includes designates the decoding strategy. - DecodeAs DecodeAs `json: "-` + DecodeAs DecodeAs `json:"-"` // Zero contains the zero value for Argument.Value. // It is automatically initialized based on ArgMeta.Type when the Core DefinitionGroup is initialized. Zero interface{} `json:"-"` From d48f44cf9eb9f57ec509dbac536cdd8433dcfba9 Mon Sep 17 00:00:00 2001 From: Nadav Strahilevitz Date: Tue, 22 Oct 2024 10:04:31 +0000 Subject: [PATCH 5/5] debug --- pkg/bufferdecoder/decoder.go | 71 +++++++++++++++++++++++++++++-- pkg/bufferdecoder/decoder_test.go | 2 +- pkg/bufferdecoder/eventsreader.go | 9 +++- pkg/ebpf/c/common/buffer.h | 24 +++++------ pkg/ebpf/c/types.h | 36 +++++++--------- pkg/ebpf/events_pipeline.go | 6 +++ 6 files changed, 110 insertions(+), 38 deletions(-) diff --git a/pkg/bufferdecoder/decoder.go b/pkg/bufferdecoder/decoder.go index 9bfcf62092b5..47eb6b900fa7 100644 --- a/pkg/bufferdecoder/decoder.go +++ b/pkg/bufferdecoder/decoder.go @@ -9,6 +9,8 @@ package bufferdecoder import ( "encoding/binary" "errors" + "fmt" + "runtime" "github.com/aquasecurity/tracee/pkg/errfmt" "github.com/aquasecurity/tracee/pkg/events" @@ -46,6 +48,9 @@ func (decoder *EbpfDecoder) BytesRead() int { // MoveCursor moves the buffer cursor over n bytes. Returns the new cursor position. func (decoder *EbpfDecoder) MoveCursor(n int) int { + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += n return decoder.cursor } @@ -88,6 +93,8 @@ func (decoder *EbpfDecoder) DecodeContext(eCtx *EventContext) error { eCtx.MatchedPolicies = binary.LittleEndian.Uint64(decoder.buffer[offset+136 : offset+144]) // event_context end + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += eCtx.GetSizeBytes() return nil } @@ -113,7 +120,7 @@ func (decoder *EbpfDecoder) DecodeArguments(args []trace.Argument, argnum int, e args[idx] = arg } - // Fill missing arguments metadata + // Fill missing arguments for i := 0; i < len(evtParams); i++ { if args[i].Value == nil { args[i].ArgMeta = evtParams[i] @@ -131,6 +138,9 @@ func (decoder *EbpfDecoder) DecodeUint8(msg *uint8) error { return ErrBufferTooShort } *msg = decoder.buffer[decoder.cursor] + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -143,6 +153,9 @@ func (decoder *EbpfDecoder) DecodeInt8(msg *int8) error { return ErrBufferTooShort } *msg = int8(decoder.buffer[offset]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -155,6 +168,9 @@ func (decoder *EbpfDecoder) DecodeUint16(msg *uint16) error { return ErrBufferTooShort } *msg = binary.LittleEndian.Uint16(decoder.buffer[offset : offset+readAmount]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -167,6 +183,9 @@ func (decoder *EbpfDecoder) DecodeUint16BigEndian(msg *uint16) error { return ErrBufferTooShort } *msg = binary.BigEndian.Uint16(decoder.buffer[offset : offset+readAmount]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -179,6 +198,9 @@ func (decoder *EbpfDecoder) DecodeInt16(msg *int16) error { return ErrBufferTooShort } *msg = int16(binary.LittleEndian.Uint16(decoder.buffer[offset : offset+readAmount])) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -191,6 +213,9 @@ func (decoder *EbpfDecoder) DecodeUint32(msg *uint32) error { return ErrBufferTooShort } *msg = binary.LittleEndian.Uint32(decoder.buffer[offset : offset+readAmount]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -203,6 +228,9 @@ func (decoder *EbpfDecoder) DecodeUint32BigEndian(msg *uint32) error { return ErrBufferTooShort } *msg = binary.BigEndian.Uint32(decoder.buffer[offset : offset+readAmount]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -215,6 +243,9 @@ func (decoder *EbpfDecoder) DecodeInt32(msg *int32) error { return ErrBufferTooShort } *msg = int32(binary.LittleEndian.Uint32(decoder.buffer[offset : offset+readAmount])) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -227,6 +258,9 @@ func (decoder *EbpfDecoder) DecodeUint64(msg *uint64) error { return ErrBufferTooShort } *msg = binary.LittleEndian.Uint64(decoder.buffer[offset : offset+readAmount]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -239,6 +273,9 @@ func (decoder *EbpfDecoder) DecodeInt64(msg *int64) error { return ErrBufferTooShort } *msg = int64(binary.LittleEndian.Uint64(decoder.buffer[decoder.cursor : decoder.cursor+readAmount])) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += readAmount return nil } @@ -250,6 +287,8 @@ func (decoder *EbpfDecoder) DecodeBool(msg *bool) error { return ErrBufferTooShort } *msg = (decoder.buffer[offset] != 0) + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor++ return nil } @@ -262,6 +301,9 @@ func (decoder *EbpfDecoder) DecodeBytes(msg []byte, size int) error { return ErrBufferTooShort } _ = copy(msg[:], decoder.buffer[offset:offset+size]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += size return nil } @@ -278,14 +320,20 @@ func (decoder *EbpfDecoder) ReadBytesLen(len int) ([]byte, error) { return res, nil } -// DecodeIntArray translate from the decoder buffer, starting from the decoder cursor, to msg, size * 4 bytes (in order to get int32). -func (decoder *EbpfDecoder) DecodeIntArray(msg []int32, size int) error { +// DecodeInt32Array translate from the decoder buffer, starting from the decoder cursor, to msg, size * 4 bytes (in order to get int32). +func (decoder *EbpfDecoder) DecodeInt32Array(msg []int32, size int) error { offset := decoder.cursor if len(decoder.buffer[offset:]) < size*4 { + fmt.Println("buffer size from offset:", decoder.cursor) + fmt.Printf("buffer from offset: %08b\n", decoder.buffer[offset:]) return ErrBufferTooShort } for i := 0; i < size; i++ { + fmt.Println("ayy lmao", i) msg[i] = int32(binary.LittleEndian.Uint32(decoder.buffer[decoder.cursor : decoder.cursor+4])) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += 4 } return nil @@ -330,6 +378,9 @@ func (decoder *EbpfDecoder) DecodeSlimCred(slimCred *SlimCred) error { slimCred.CapEffective = binary.LittleEndian.Uint64(decoder.buffer[offset+56 : offset+64]) slimCred.CapBounding = binary.LittleEndian.Uint64(decoder.buffer[offset+64 : offset+72]) slimCred.CapAmbient = binary.LittleEndian.Uint64(decoder.buffer[offset+72 : offset+80]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(slimCred.GetSizeBytes()) return nil } @@ -345,6 +396,9 @@ func (decoder *EbpfDecoder) DecodeChunkMeta(chunkMeta *ChunkMeta) error { _ = copy(chunkMeta.Metadata[:], decoder.buffer[offset+9:offset+37]) chunkMeta.Size = int32(binary.LittleEndian.Uint32(decoder.buffer[offset+37 : offset+41])) chunkMeta.Off = binary.LittleEndian.Uint64(decoder.buffer[offset+41 : offset+49]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(chunkMeta.GetSizeBytes()) return nil } @@ -359,6 +413,9 @@ func (decoder *EbpfDecoder) DecodeVfsFileMeta(vfsFileMeta *VfsFileMeta) error { vfsFileMeta.Inode = binary.LittleEndian.Uint64(decoder.buffer[offset+4 : offset+12]) vfsFileMeta.Mode = binary.LittleEndian.Uint32(decoder.buffer[offset+12 : offset+16]) vfsFileMeta.Pid = binary.LittleEndian.Uint32(decoder.buffer[offset+16 : offset+20]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(vfsFileMeta.GetSizeBytes()) return nil } @@ -373,6 +430,9 @@ func (decoder *EbpfDecoder) DecodeKernelModuleMeta(kernelModuleMeta *KernelModul kernelModuleMeta.Inode = binary.LittleEndian.Uint64(decoder.buffer[offset+4 : offset+12]) kernelModuleMeta.Pid = binary.LittleEndian.Uint32(decoder.buffer[offset+12 : offset+16]) kernelModuleMeta.Size = binary.LittleEndian.Uint32(decoder.buffer[offset+16 : offset+20]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(kernelModuleMeta.GetSizeBytes()) return nil } @@ -387,6 +447,9 @@ func (decoder *EbpfDecoder) DecodeBpfObjectMeta(bpfObjectMeta *BpfObjectMeta) er bpfObjectMeta.Rand = binary.LittleEndian.Uint32(decoder.buffer[offset+16 : offset+20]) bpfObjectMeta.Pid = binary.LittleEndian.Uint32(decoder.buffer[offset+20 : offset+24]) bpfObjectMeta.Size = binary.LittleEndian.Uint32(decoder.buffer[offset+24 : offset+28]) + + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(bpfObjectMeta.GetSizeBytes()) return nil } @@ -400,6 +463,8 @@ func (decoder *EbpfDecoder) DecodeMprotectWriteMeta(mprotectWriteMeta *MprotectW mprotectWriteMeta.Ts = binary.LittleEndian.Uint64(decoder.buffer[offset : offset+8]) mprotectWriteMeta.Pid = binary.LittleEndian.Uint32(decoder.buffer[offset+8 : offset+12]) + pc, _, _, _ := runtime.Caller(0) + fmt.Println("increased cursor in line", runtime.FuncForPC(pc).Name()) decoder.cursor += int(mprotectWriteMeta.GetSizeBytes()) return nil } diff --git a/pkg/bufferdecoder/decoder_test.go b/pkg/bufferdecoder/decoder_test.go index 6d7900b6ff3c..78beb51dbaf3 100644 --- a/pkg/bufferdecoder/decoder_test.go +++ b/pkg/bufferdecoder/decoder_test.go @@ -354,7 +354,7 @@ func TestDecodeIntArray(t *testing.T) { raw = append(raw, 1, 2, 3, 4, 5, 6, 7, 8) decoder := New(raw) var obtained [2]int32 - err := decoder.DecodeIntArray(obtained[:], 2) + err := decoder.DecodeInt32Array(obtained[:], 2) assert.Equal(t, nil, err) rawcp := append(raw, 1, 2, 3, 4, 5, 6, 7, 8) dataBuff := bytes.NewBuffer(rawcp) diff --git a/pkg/bufferdecoder/eventsreader.go b/pkg/bufferdecoder/eventsreader.go index 7af153d3cbcb..ff5d14018987 100644 --- a/pkg/bufferdecoder/eventsreader.go +++ b/pkg/bufferdecoder/eventsreader.go @@ -2,6 +2,7 @@ package bufferdecoder import ( "encoding/binary" + "fmt" "net" "strconv" "strings" @@ -26,6 +27,8 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A var argIdx uint8 var arg trace.Argument + fmt.Printf("buffer from offset: %08b\n", ebpfMsgDecoder.buffer[ebpfMsgDecoder.cursor:]) + err = ebpfMsgDecoder.DecodeUint8(&argIdx) if err != nil { return 0, arg, errfmt.Errorf("error reading arg index: %v", err) @@ -33,8 +36,11 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A if int(argIdx) >= len(params) { return 0, arg, errfmt.Errorf("invalid arg index %d", argIdx) } + fmt.Println("bytes read 3", ebpfMsgDecoder.BytesRead()) + arg.ArgMeta = params[argIdx] argType := GetDecodeType(arg.Type) + fmt.Println("read arg from buff: ", argIdx, argType) switch argType { case trace.U8_T: @@ -130,7 +136,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A res, err = ebpfMsgDecoder.ReadBytesLen(int(size)) case trace.INT_ARR_2_T: var intArray [2]int32 - err = ebpfMsgDecoder.DecodeIntArray(intArray[:], 2) + err = ebpfMsgDecoder.DecodeInt32Array(intArray[:], 2) if err != nil { return uint(argIdx), arg, errfmt.Errorf("error reading int elements: %v", err) } @@ -160,6 +166,7 @@ func readArgFromBuff(id events.ID, ebpfMsgDecoder *EbpfDecoder, params []trace.A return uint(argIdx), arg, errfmt.WrapError(err) } arg.Value = res + fmt.Println("bytes read 4", ebpfMsgDecoder.BytesRead()) return uint(argIdx), arg, nil } diff --git a/pkg/ebpf/c/common/buffer.h b/pkg/ebpf/c/common/buffer.h index ea9fee7955d9..4e08c8b5f978 100644 --- a/pkg/ebpf/c/common/buffer.h +++ b/pkg/ebpf/c/common/buffer.h @@ -340,14 +340,16 @@ statfunc int save_sockaddr_to_buf(args_buffer_t *buf, struct socket *sock, u8 in #define DEC_ARG(n, enc_arg) ((enc_arg >> (8 * n)) & 0xFF) +// types whose arguments needs to be directly in type_size_table (arg = (void *) args->args[i]) #define BITMASK_INDIRECT_VALUE_TYPES \ - ((u64) 1 << STR_T | (u64) 1 << SOCKADDR_T | (u64) 1 << INT_ARR_2_T | (u64) 1 << TIMESPEC_T) + ((u64) 1 << INT_ARR_2_T | (u64) 1 << STR_T | (u64) 1 << SOCKADDR_T | (u64) 1 << TIMESPEC_T) +// types whose arguments needs to be handled through their address in type_size_table +// ((arg = (void *) &args->args[i])) #define BITMASK_COMMON_TYPES \ ((u64) 1 << INT_T | (u64) 1 << UINT_T | (u64) 1 << LONG_T | (u64) 1 << ULONG_T | \ - (u64) 1 << OFF_T_T | (u64) 1 << MODE_T_T | (u64) 1 << DEV_T_T | (u64) 1 << SIZE_T_T | \ - (u64) 1 << POINTER_T | (u64) 1 << STR_ARR_T | (u64) 1 << BYTES_T | (u64) 1 << U16_T | \ - (u64) 1 << CRED_T | (u64) 1 << UINT64_ARR_T | (u64) 1 << U8_T) + (u64) 1 << U16_T | (u64) 1 << U8_T | (u64) 1 << UINT64_ARR_T | (u64) 1 << POINTER_T | \ + (u64) 1 << BYTES_T | (u64) 1 << STR_ARR_T| (u64) 1 << U8_T) #define ARG_TYPE_MAX_ARRAY (u8) TIMESPEC_T // last element defined in argument_type_e @@ -359,20 +361,16 @@ static u8 type_size_table[ARG_TYPE_MAX_ARRAY + 1] = { [UINT_T] = sizeof(unsigned int), [LONG_T] = sizeof(long), [ULONG_T] = sizeof(unsigned long), - [OFF_T_T] = sizeof(off_t), - [MODE_T_T] = sizeof(mode_t), - [DEV_T_T] = sizeof(dev_t), - [SIZE_T_T] = sizeof(size_t), + [U16_T] = sizeof(unsigned short), + [U8_T] = sizeof(unsigned char), + [INT_ARR_2_T] = sizeof(int[2]), + [UINT64_ARR_T] = 0, [POINTER_T] = sizeof(void *), + [BYTES_T] = 0, [STR_T] = 0, [STR_ARR_T] = 0, [SOCKADDR_T] = sizeof(short), - [BYTES_T] = 0, - [U16_T] = sizeof(u16), [CRED_T] = sizeof(struct cred), - [INT_ARR_2_T] = sizeof(int[2]), - [UINT64_ARR_T] = 0, - [U8_T] = sizeof(u8), [TIMESPEC_T] = 0, }; diff --git a/pkg/ebpf/c/types.h b/pkg/ebpf/c/types.h index b8679fd68b71..f30ab5bf54db 100644 --- a/pkg/ebpf/c/types.h +++ b/pkg/ebpf/c/types.h @@ -158,26 +158,22 @@ typedef struct args { // pkg/bufferdecoder/eventsreader.go. enum argument_type_e { - NONE_T = 0UL, - INT_T, - UINT_T, - LONG_T, - ULONG_T, - OFF_T_T, - MODE_T_T, - DEV_T_T, - SIZE_T_T, - POINTER_T, - STR_T, - STR_ARR_T, - SOCKADDR_T, - BYTES_T, - U16_T, - CRED_T, - INT_ARR_2_T, - UINT64_ARR_T, - U8_T, - TIMESPEC_T, + NONE_T = 0UL, // Default value - the argument does not originate from a decodable buffer. + INT_T, + UINT_T, + LONG_T, + ULONG_T, + U16_T, + U8_T, + INT_ARR_2_T, + UINT64_ARR_T, + POINTER_T, + BYTES_T, + STR_T, + STR_ARR_T, + SOCKADDR_T, + CRED_T, + TIMESPEC_T, TYPE_MAX = 255UL }; diff --git a/pkg/ebpf/events_pipeline.go b/pkg/ebpf/events_pipeline.go index edfb72416627..32a40752f81d 100644 --- a/pkg/ebpf/events_pipeline.go +++ b/pkg/ebpf/events_pipeline.go @@ -4,6 +4,7 @@ import ( "bytes" "context" "encoding/binary" + "fmt" "slices" "strconv" "sync" @@ -166,16 +167,21 @@ func (t *Tracee) decodeEvents(ctx context.Context, sourceChan chan []byte) (<-ch defer close(errc) for dataRaw := range sourceChan { ebpfMsgDecoder := bufferdecoder.New(dataRaw) + fmt.Printf("data: %08b", dataRaw) var eCtx bufferdecoder.EventContext if err := ebpfMsgDecoder.DecodeContext(&eCtx); err != nil { t.handleError(err) continue } + fmt.Println("bytes read 1", ebpfMsgDecoder.BytesRead()) var argnum uint8 if err := ebpfMsgDecoder.DecodeUint8(&argnum); err != nil { t.handleError(err) continue } + fmt.Println("bytes read 2", ebpfMsgDecoder.BytesRead()) + + fmt.Println("event args num", argnum) eventId := events.ID(eCtx.EventID) if !events.Core.IsDefined(eventId) { t.handleError(errfmt.Errorf("failed to get configuration of event %d", eventId))